Missing authorization check in IS-B-DP-EDT, SAP security note 1686172

SAP Note 1686172
SAP Security Note
High priority

SAP security note 1686172, “Missing Authorization Check in IS-B-DP-EDT”, is a program error note released on 13.11.2012. Below are the symptom, SAP recommended solution and the affected software components.

ComponentIndustry-Specific Components > Bank > Transaction Datapool > External Data Transfer (IS-B-DP-EDT)

CategoryProgram error

PriorityCorrection with high priority

TypeSAP Security Note

Version4

StatusReleased for Customer

Released on13.11.2012

LanguageEnglish

Description

Symptom

An authenticated user can utilize functions of IS-B-DP-EDT that should be restricted, potentially resulting in an escalation of privileges.

Solution

Implement the provided correction instructions to address the authorization check deficiencies.

Reason and prerequisites

The IS-B-DP-EDT component lacks proper authorization checks for certain functions, which may lead to undesired system behavior.

CVSS

Score 4.0 Vector: AV:N/AC:L/AU:S/C:P/I:N/A:N

References

This note refers to

SAP Note 888889 – Automatic checks for security notes using RSECNOTE (outdated)

Referenced by

SAP Note 888889 – Automatic checks for security notes using RSECNOTE (outdated)

Affected components

SAP_ABA 620
SAP_ABA 640
SAP_ABA 700 to 702
SAP_ABA 710 to 711
SAP_ABA 730
SAP_ABA 731

Full note on SAP: SAP Support Launchpad note 1686172

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#IS-B-DP-EDT #Authorization check #Banking #Privilege escalation