SAP security note 1682613, “Missing authorization check in core service”. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
An unauthenticated user can use functions of the file service to which access should be restricted. This may result in an escalation of privileges.
Solution
Apply the Patch Level for your version and service pack that contains all the fixes attached to this note. For details, check the validity section below.
Reason and prerequisites
One of the core services does not contain authorization checks for verifying an unauthenticated user's authorization to access some of its functions. This may result in undesired system behavior.
CVSS
Score 10 Vector: AV:N/AC:L/AU:N/C:C/I:C/A:C
Affected components
- SAP-JEE: 6.40
- SAP-JEECOR: 6.40, 7.00, 7.01 – 7.02
- SERVERCORE: 7.10 – 7.31
Full note on SAP: SAP Support Launchpad note 1682613
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].