Missing authorization check in component IS-B-BCA, SAP security note 1625060

SAP Note 1625060SAP Security Note

SAP security note 1625060, “Missing authorization check in component IS-B-BCA”, is a note released on 11.10.2011. Below are the symptom, SAP recommended solution and the affected software components.

TypeSAP Security Note

Released on11.10.2011

Description

Symptom

An authenticated user can use functions of IS-B-BCA to which access should be restricted. This may result in an escalation of privileges.

Solution

Implement the advance correction according to the attached correction instructions or import the corresponding support package.

CVSS

Score 0

References

This note refers to

888889 – Automatic checks for security notes using RSECNOTE (outdated)

Referenced by

888889 – Automatic checks for security notes using RSECNOTE (outdated)

Affected components

EA-FINSERV 500
EA-FINSERV 600
EA-FINSERV 603
EA-FINSERV 604
EA-FINSERV 605
EA-FINSERV 606

Full note on SAP: SAP Support Launchpad note 1625060

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#IS-B-BCA #Authorization check #Privilege escalation