SAP security note 1534608, "Missing authorization check in IAC postprocessing". Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
An authenticated user can exploit the Internet Application Component (IAC) postprocessing functions without proper authorization checks, potentially leading to privilege escalation. This vulnerability affects SAP component IS-M-SD-PS-SL-O.
Solution
A correction for this vulnerability will be available with the next Support Package. In the meantime, you can manually implement the necessary corrections using the Note Assistant by following the manual pre-implementation steps provided in the note.
References
Affected components
- IS-M releases from 464 to 605
Full note on SAP: SAP Support Launchpad note 1534608
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
