Skip links
RedRays - Your SAP Security Solution
Picture of Vahagn Vardanian

Vahagn Vardanian

Co-founder and CTO of RedRays

SAP Security on Udemy

Cross-Tenant Priv Escalation LOD-ESO-AS, SAP security note 1661738

SAP Note 1661738
SAP Security Note
High priority

SAP security note 1661738, “Cross-Tenant Priv Escalation LOD-ESO-AS”, released on 13.03.2012. Below are the symptom, SAP recommended solution and the affected software components.

ComponentOnDemand > Sourcing OnDemand > Accounts & Security (LOD-ESO-AS)
PriorityCorrection with high priority
TypeSAP Security Note
Version2
StatusReleased for Customer
Released on13.03.2012
LanguageEnglish

Description

Symptom

LOD-ESO-AS can be abused by a malicious user via cross tenant privilege escalation. This affects Multi-Tenant systems only.

Solution

Fixes have been developed and released in version 5.0 J, Version 5.1 Patch 10, and all Version 7.0 SP and patch releases. Update to the appropriate Release / Patch version to mitigate this risk.

Reason and prerequisites

During internal testing, a cross tenant access vulnerability was identified.

CVSS

Score 0

Affected components

  • ESOUSRMJAVASERVER: 5.0 to 5.0
  • ESOUSRMJAVASERVER: 5.1 to 5.1

Full note on SAP: SAP Support Launchpad note 1661738

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#Cross Tenant Privilege Vulnerability #LOD-ESO-AS #Multi-Tenant Security #Privilege Escalation

Explore More