SAP security note 1750997, "Missing authorization check in BC-FES-CTL", is a note. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
Authenticated users can access and use functions within BC-FES-CTL that should be restricted, allowing unauthorized privilege escalation.
Solution
Apply the correction instructions detailed in SAP Security Note 1750997 using SNOTE.
Reason and prerequisites
BC-FES-CTL lacks proper authorization checks to verify an authenticated user's permissions for accessing certain functions. This omission can lead to unintended system behavior and potential security breaches.
CVSS
Score 6.0 Vector: AV:N/AC:M/AU:S/C:P/I:P/A:P
References
Affected components
- Basis Components > Frontend Services (SAP Note 1322184) > SAP GUI for Windows Controls (BC-FES-CTL)
- SAP_BASIS 620 to 640+
- SAP_BASIS 700 to 702+
- SAP_BASIS 710 to 730+
- SAP_BASIS 731 to 731+
- SAP_BASIS 803 to 804+
- SAP_BASIS 740 to 740+
Full note on SAP: SAP Support Launchpad note 1750997
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
