SAP Security Note
Medium priority
SAP security note 2099484, "Missing authorization check in Payment Engine", is a program error note released on 04.06.2015. Below are the symptom and SAP recommended solution.
Description
Symptom
An authenticated user can use functions of Payment Engine to which access should be restricted. This may result in an escalation of privileges.
Solution
Apply the preliminary correction according to the correction instructions included in this SAP Note or via the Support Package. Please note that manual steps are required.
Additionally, implementation of SAP Note 1882417 is a necessary requirement.
Reason and prerequisites
Payment Engine does not contain authorization checks for verifying an authenticated user's authorization to access certain functions. This may result in undesired system behavior.
Full note on SAP: SAP Support Launchpad note 2099484
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].