SAP security note 1553907, "Missing authorization check in Debugger Infrastructure", is a note. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
An authenticated user can use functions of the debugger infrastructure to which access should be restricted. This may result in an escalation of privileges.
Solution
Please apply the support package mentioned in this note at least, or the corresponding correction instructions.
Reason and prerequisites
Debugger infrastructure does not contain authorization checks for verifying an authenticated user’s authorization to access certain functions. This may result in undesired system behavior.
CVSS
Score 8.7 Vector: AV:N/AC:L/Au:S/C:C/I:C/A:P
Affected components
- SAP_BASIS: From 700 to 702
- SAP_BASIS: From 710 to 730
- SAP_BASIS: From 72L to 800
Full note on SAP: SAP Support Launchpad note 1553907
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].