SAP security note 1889895, "Missing authorization check in BC-CUS-TOL-BCD". Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
An authenticated user can use functions of BC-CUS-TOL-BCD to which access should be restricted. This may result in an escalation of privileges.
Solution
Apply the corrections provided in this SAP Note.
Reason and prerequisites
BC-CUS-TOL-BCD does not contain authorization checks for verifying an authenticated user’s authorization to access certain functions. This may result in undesired system behavior.
CVSS
Score 6.3 Vector: AV:N/AC:M/AU:S/C:C/I:N/A:N
Affected components
- SAP_BASIS: Versions 46C, 620 to 640, 700 to 702, 710 to 730, 731, 740
Full note on SAP: SAP Support Launchpad note 1889895
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
