Missing authorization check in IS-U-CA, SAP security note 2253026

SAP security note 2253026, "Missing authorization check in IS-U-CA", is a program error note released on 23.06.2017. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

An authenticated user has access to functions of IS-U-CA, even though access to these functions should be restricted. This may result in an escalation of privileges.

Solution

Implement the correction instructions provided in the SAP Security Note.

Reason and prerequisites

In IS-U-CA, authorization checks are missing which verify an authenticated user’s authorization to access certain functions. This omission can lead to undesired system behavior.

Affected components

• IS-UT (600, 602, 603, 604, 605, 606, 616, 617, 618)