Missing authorization check in Output Server, SAP security note 1565444

SAP security note 1565444, "Missing authorization check in Output Server", released on May 10, 2011. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

An authenticated user can use functions of Output Server to which access should be restricted. This may result in an escalation of privileges.

Solution

Apply the support package mentioned in this note or follow the correction instructions provided.

Reason and prerequisites

Output Server lacks authorization checks for verifying an authenticated user's permissions to access certain functions, potentially leading to undesired system behavior.

CVSS

Score 3.5 Vector: AV:N/AC:M/AU:S/C:P/I:N/A:N

References

• SAP Note 888889: Automatic checks for security notes using RSECNOTE (outdated)

Affected components

• SAP_BASIS 700 to 702
• SAP_BASIS 710 to 730
• SAP_BASIS 72L