SAP security note 1776984, "Missing authorization check in component SAP_BASIS". Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
An authenticated user can exploit functions across different SAP components or products without proper access restrictions, potentially leading to privilege escalation.
Solution
Apply the correction instructions provided in this security note. This involves disabling the affected function’s coding, which will return an error message instead. For compatibility, customers can modify the function module to uncomment the coding at their own responsibility. Starting from NetWeaver 740 (SAP_BASIS 740), the function has been removed by SAP.
CVSS
Score 6.0 Vector: AV:N/AC:M/AU:S/C:P/I:P/A:P
Affected components
- SAP_BASIS (Enterprise Service Infrastructure > Web Service Infrastructure > Web Service and SOAP – ABAP), versions 700 to 702, 710 to 730, 731
Full note on SAP: SAP Support Launchpad note 1776984
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].