SAP security note 1819822, “Missing authorization check in configuration service”, is a note released on April 9, 2013. Below are the symptom and SAP recommended solution.
Description
Symptom
An authenticated user can use functions of the configuration service that should be actually restricted. This may result in an escalation of privileges.
Solution
Apply the patch level for your version and service pack that contains all the fixes attached to this note. For details, check the Validity section.
Reason and prerequisites
The configuration service does not check an authenticated user’s authorization to allow access to its functions. This may result in undesired system behavior and potential privilege escalation.
CVSS
Score 5.0 Vector: AV:N/AC:L/AU:N/C:P/I:N/A:N
Full note on SAP: SAP Support Launchpad note 1819822
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
