SAP security note 1595074, “Missing authorization check in function group SAL3”. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
An authenticated user can use functions of function group SAL3 to which access should be restricted. This may result in an escalation of privileges.
Solution
Import the Support Package or implement the attached correction instructions.
Reason and prerequisites
The function group SAL3 does not contain authorization checks for verifying an authenticated user's authorization to access some of its functions. This may lead to undesired system behavior.
CVSS
Score 6.0 Vector: AV:N/AC:M/AU:S/C:P/I:P/A:P
Affected components
- SAP_BASIS 700 to 702
- SAP_BASIS 710 to 730
- SAP_BASIS 731 to 731
- SAP_BASIS 800 to 802
Full note on SAP: SAP Support Launchpad note 1595074
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
