Missing Authorization check in LT Replication Server (SLT), SAP security note 2321240

SAP security note 2321240, "Missing Authorization Check in LT Replication Server (SLT)", is a program error note released on July 12, 2016. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

The Landscape Transformation Replication Server (SLT) does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.

Some well-known impacts of Missing Authorization check are:

• Abuse functionality restricted to a particular user group
• Read, modify, or delete restricted data

Solution

Apply the note correction to every system with the software component DMIS. It isn’t necessary to stop or pause running replication scenarios.

CVSS

Score 5.5 Vector: AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

Affected components

• DMIS: 2010_1_46C to 2011_1_731