Missing Authorization Check in BC-CCM-MON, SAP security note 1616366

SAP security note 1616366, “Missing Authorization Check in BC-CCM-MON”, is a program error note released on 18.04.2013. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

This security note has been updated. For more detailed information, see Security Note 1845532. An authenticated user can use functions of BC-CCM-MON to which access should be restricted. This may result in an escalation of privileges.

Solution

Please implement the attached correction instructions or the appropriate support package.

Reason and prerequisites

BC-CCM-MON does not contain authorization checks for verifying an authenticated user’s permissions to access certain functions. This may result in undesired system behavior.

CVSS

Score 2.1 Vector: AV:N/AC:H/AU:S/C:P/I:N/A:N

References

• Security Note 1845532
• Automatic checks for security notes using RSECNOTE (outdated)

Affected components

• SAP_APPL: 40B to 40B
• SAP_APPL: 45A to 45B
• SAP_APPL: 46C to 46C
• SAP_BASIS: 46A to 46D
• SAP_BASIS: 610 to 640
• SAP_BASIS: 700 to 702
• SAP_BASIS: 710 to 730
• SAP_BASIS: 731 to 731