SAP security note 1821019, “Missing authorization check in package SPFL”. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
An authenticated user can use certain functions of SAP systems without having the required authorization for this.
Solution
The problem is solved as of the listed Support Packages. Alternatively, you can implement the relevant correction instructions.
Reason and prerequisites
SAP systems do not contain authorization checks for verifying an authenticated user’s authorization to access some of their functions. Without these checks, an authenticated user can call these functions without this being the desired system behavior.
CVSS
Score 2.3 Vector: AV:A/AC:M/AU:S/C:P/I:N/A:N
References
Affected components
- SAP_BASIS 46C
- SAP_BASIS 46D
- SAP_BASIS 620
- SAP_BASIS 640
- SAP_BASIS 700
- SAP_BASIS 702
- SAP_BASIS 710
- SAP_BASIS 730
- SAP_BASIS 731
- SAP_BASIS 740
Full note on SAP: SAP Support Launchpad note 1821019
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
