SAP Note 1518763
SAP security note 1518763, "Missing Authorization Check for ABAP Unit in editor tools". Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
A user with authorization to display source code can launch unit tests from within some editor tools. This can potentially result in an escalation of privileges.
Solution
Apply a recent support package.
Reason and prerequisites
Some editors have not checked the authority to execute programs before launching the unit tests.
References
Affected components
- SAP_BASIS: 640
- SAP_BASIS: 700 – 702
- SAP_BASIS: 710 – 730
Full note on SAP: SAP Support Launchpad note 1518763
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
