SAP Security Note
High priority
SAP security note 2058959, "Missing authorization check in BC-MOB-MI-SER", is a program error note released on 11.11.2014. Below are the symptom and SAP recommended solution.
Description
Symptom
An authenticated user can use functions of BC-MOB-MI-SER to which access should be restricted. This may result in an escalation of privileges.
Solution
The note provides the necessary correction. To apply this security fix, upgrade the Server to at least the patch level specified in the Support Packages & Patches section of this note, relevant to your release.
Reason and prerequisites
BC-MOB-MI-SER does not contain authorization checks for verifying an authenticated user’s permissions to access certain functions. This may lead to undesired system behavior.
Full note on SAP: SAP Support Launchpad note 2058959
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].