SAP Note 1640584
SAP Security Note
Medium priority
SAP Security Note
Medium priority
SAP security note 1640584, "Missing authorization check for maintenance of trust", is a program error note released on 14.08.2018. Below are the symptom and SAP recommended solution.
Description
Symptom
Missing authorization check for access control for trusts.
Solution
Please import the relevant support package.
Reason and prerequisites
During the access control for RFC and HTTP requests that use a trust between the involved systems, authorization checks that verify the authorization of an authenticated user to access certain functions are missing. This can result in undesired system behavior.
Full note on SAP: SAP Support Launchpad note 1640584
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
