SAP security note 1487475, "Missing authorization check for property conversion", was released on 14.12.2010. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
A user who is logged on can call certain functions of the property conversion, even though this user does not have the required authorization. This may lead to an escalation of privileges.
Solution
Implement this note to ensure that the necessary authorization checks are in place, preventing unauthorized users from accessing critical functions related to property conversion.
Reason and prerequisites
Authorization checks that control the access to the functions are missing in the report ISU_CREATE_FUNCLOC_FOR_AREA. Without these checks, a user who is logged on can easily call these functions, which may lead to an unwanted change of the system response.
Affected components
- IS-U/CCS 472
- IS-UT 600, 602, 603, 604, 605
Full note on SAP: SAP Support Launchpad note 1487475
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
