SAP security note 1715734, "Missing authorization check in dbpool administration". Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
An authenticated user can use functions of dbpool to which access should be restricted. This may result in an escalation of privileges.
Update 14th May 2019: This note contains a partial fix. Please implement Note 2664504 for a complete fix. If you have not implemented this note, then implement only 2664504. Additionally, CVSS information is also made available.
Solution
Update your AS Java to a Support Package or release where the issue is fixed. See the SP Patch Level section below for details and available patches.
Reason and prerequisites
dbpool does not contain authorization checks for verifying an authenticated user’s authorization to access certain functions. This may result in undesired system behavior.
CVSS
Score 4.7 Vector: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
References
Affected components
- SAP-JEE
- SAP-JEECOR
- SERVERCORE
Full note on SAP: SAP Support Launchpad note 1715734
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].