Missing authentication step in PI, SAP security note 1557806

SAP security note 1557806, "Missing authentication step in PI", is a program error note released on 13.09.2011. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

A malicious user can use functions of PI to which access should be restricted. This may result in an escalation of privileges.

Solution

The following (and newer) Support Packages contain a fix for the described security issue: PI 7.10 SP13, PI 7.11 SP07, PI 7.30 SP03.

For older Support Packages, the correction is available as a patch. Please update the software components of the Adapter Engine to the patch levels maintained in the "SP Patch Level" section of this note or use newer versions.

The archives and the support package stack guide can be found on the SAP Service Marketplace as described in SAP Note 952402.

Reason and prerequisites

The servlets for runtime checks of Integration Directory, Integration Repository, and Mapping Runtime are missing authentication steps. This may result in undesired system behavior.

CVSS

Score 0

References

Affected components

• SAP_XIESR: 7.10 to 7.11, 7.30, 7.31
• SAP_XITOOL: 7.10 to 7.11, 7.30, 7.31
• SAP_XIAF: 7.10 to 7.11, 7.30, 7.31