SAP Security Note
High Priority
SAP security note 1368764, "Authorization Check Missing in AM-CMS and AO-CMS Services", is released on September 13, 2011. Below are the symptom and SAP recommended solution.
Description
Symptom
An unauthenticated user can use functions of the Collateral Management System (CMS) to which access should be restricted. This may result in an escalation of privileges.
Solution
Apply the correction instruction or import the support package SAPKISC309.
Reason and prerequisites
Collateral Management System does not contain authorization checks for verifying an unauthenticated user’s authorization to access certain functions. This may result in undesired system behavior.
Full note on SAP: SAP Support Launchpad note 1368764
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].