Missing authorization check in IS-A-ESD, SAP security note 1860258

SAP security note 1860258, “Missing authorization check in IS-A-ESD”, is a note. Below are the symptom and SAP recommended solution.

Description

Symptom

An authenticated user can use functions of IS-A-ESD to which access should be restricted. This may result in an escalation of privileges.

Solution

Implement the attached instructions. You can download the correction instructions here.

Reason and prerequisites

IS-A-ESD does not contain authorization checks for checking an authenticated user’s authorization to access some of its functions. This may result in undesired system behavior.

CVSS

Score 4.6 Vector: AV:N/AC:H/AU:S/C:P/I:P/A:P

References