SAP Note 2728839
SAP security note 2728839, "Missing Authorization check in ABAP Platform". Below are the symptom and SAP recommended solution.
Description
Symptom
Customizing functionality of ABAP Platform does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.
- Abuse functionality restricted to a particular user group
- Read, modify, or delete restricted data
Solution
By this correction, an authorization check T_CODE with the value "SPRO" is introduced for the entry point used by other transactions, such as from the transport organizer.
- For SAP on-premise products: You need to implement the Support Package provided in this SAP Note or follow the respective correction instructions.
- For SAP S/4HANA Cloud: The correction has been implemented by SAP operations.
Side effects
CVSS
Score 5.4 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Full note on SAP: SAP Support Launchpad note 2728839
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].