Missing authentication check due to policy domain misuse, SAP security note 1543590

SAP security note 1543590, "Missing authentication check due to policy domain misuse", is a program error note released on August 9, 2011. Below are the symptom and SAP recommended solution.

Description

Symptom

Under certain conditions, an unauthenticated user can use functions to which access should be restricted. This may result in an escalation of privileges.

Solution

Update AS Java to the next patch level of the Support Package (SP). Refer to the Support Package Patch section below for detailed information.

Reason and prerequisites

A programmatic error in session and security policy domain handling might lead to missing authentication checks for accessing protected resources, resulting in undesired system behavior.