SAP Security Note
Medium priority
SAP security note 2178356, “Missing authorization check in BPM”, is a program error note released on 14.08.2015. Below are the symptom and SAP recommended solution.
Description
Symptom
An authenticated user can use functions of BPM to which access should be restricted. This may result in an information leak.
Solution
To address this issue, apply the appropriate patch corresponding to your support package version as listed in the patch table below. Follow the instructions provided in the SAP NetWeaver Support Package Stack Guide.
Reason and prerequisites
BPM did not perform authorization checks for verifying an authenticated user’s permissions to access certain functions. This oversight may lead to undesired system behavior.
Full note on SAP: SAP Support Launchpad note 2178356
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].