Missing authorization check in ACC, SAP security note 1633817

SAP security note 1633817, "Missing authorization check in ACC", is a note released on January 10, 2012. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

An authenticated user can use functions of Adaptive Computing Controller to which access should be restricted. This may result in an escalation of privileges.

Solution

Deploy the latest Support Package (SP) or Hotfix.

Reason and prerequisites

The Adaptive Controller does not contain an authorization check at a certain place for checking an authenticated user’s authorization to access some of its functions. This may result in undesired system behavior.

Affected components

• BC-AC-7XX: Basis Components > Adaptive Computing > Adaptive Computing Controller 7.xx (LMACC 7.20, LMACC 7.30)