Missing authorization check in BC-ILM-LCM, SAP security note 1848996

SAP security note 1848996, "Missing authorization check in BC-ILM-LCM". Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

An authenticated user can use functions of BC-ILM-LCM to which access should be restricted. This may result in an escalation of privileges.

Solution

Please apply this note or the corresponding support pack.

Reason and prerequisites

BC-ILM-LCM does not contain authorization checks for verifying an authenticated user’s authorization to access certain functions. This may result in undesired system behavior.

CVSS

Score 6.0 Vector: AV:N/AC:M/AU:S/C:P/I:P/A:P

References

• 888889 – Automatic checks for security notes using RSECNOTE (outdated)

Affected components

• SAP_BASIS 701 to 702
• SAP_BASIS 730
• SAP_BASIS 731
• SAP_BASIS 740