Missing authorization check in CRM-BTX-ANA., SAP security note 2147415

SAP Note 2147415
SAP Security Note
High priority

SAP security note 2147415, “Missing authorization check in CRM-BTX-ANA”, is a program error note released on 14.07.2015. Below are the symptom and SAP recommended solution.

ComponentCRM-BTX-ANA

CategoryProgram error

PriorityHigh priority

TypeSAP Security Note

Version2

StatusReleased for Customer

Released on14.07.2015

LanguageEnglish

Description

Symptom

An authenticated user can use functions of CRM-BTX-ANA to which access should be restricted. This may result in an escalation of privileges.

Solution

Implement the corrections present in the note.

Reason and prerequisites

CRM-BTX-ANA does not contain authorization checks for verifying an authenticated user’s authorization to access some of its functions. This may result in undesired system behavior.

Full note on SAP: SAP Support Launchpad note 2147415

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#CRM-BTX-ANA #authorization check #privilege escalation