SAP security note 1852738, "Missing authorization check in PA-PA-ZA", is a note released on 09.07.2013. Below are the symptom and SAP recommended solution.
Description
Symptom
An authenticated user can use functions of PA-PA-ZA to which access should be restricted. This may result in an escalation of privileges.
Solution
The function module where the issue exists is currently not supported by SAP. The code which was a security threat has been commented.
Apply the relevant HR support package to resolve the issue. Alternatively, apply the attached correction instructions.
Reason and prerequisites
PA-PA-ZA does not contain authorization checks for checking an authenticated user's authorization to access some of its functions. This may result in undesired system behavior.
CVSS
Score 6.0 Vector: AV:N/AC:M/AU:S/C:P/I:P/A:P
Full note on SAP: SAP Support Launchpad note 1852738
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
