Missing authorization check in CDOP, SAP security note 1795948

SAP Note 1795948
SAP Security Note
High priority

SAP security note 1795948, "Missing authorization check in CDOP", is a program error note released on 12.02.2013. Below are the symptom, SAP recommended solution and the affected software components.

ComponentCross-Application Components > European Monetary Union – Euro (CA-EUR)

CategoryProgram error

PriorityCorrection with high priority

TypeSAP Security Note

Version3

StatusReleased for Customer

Released on12.02.2013

LanguageEnglish

Description

Symptom

An authenticated user can use functions of CDOP (software component DMIS) to which access should be restricted. This may result in an escalation of privileges.

Solution

Implement the correction instruction in all affected systems (i.e., all systems that contain software component DMIS).

Reason and prerequisites

CDOP does not contain authorization checks for verifying an authenticated user's authorization to access certain functions. This may result in undesired system behavior.

CVSS

Score 6.0 Vector: AV:N/AC:M/AU:S/C:P/I:P/A:P

Affected components

DMIS 2006_1_46C
DMIS 2006_1_620
DMIS 2006_1_640
DMIS 2006_1_700
DMIS 2006_1_710
DMIS 2010_1_46C
DMIS 2010_1_620
DMIS 2010_1_640
DMIS 2010_1_700
DMIS 2010_1_710
DMIS 2011_1_620
DMIS 2011_1_640
DMIS 2011_1_700
DMIS 2011_1_710
DMIS 2011_1_730
DMIS 2011_1_731

Full note on SAP: SAP Support Launchpad note 1795948

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#CA-EUR #European Monetary Union #Euro #DMIS