SAP Security Note
Medium priority
SAP security note 1593247, "Missing authorization check in PP-MES", is a note released on May 8, 2012. Below are the symptom and SAP recommended solution.
Description
Symptom
An authenticated user can use functions of PP-MES to which access should be restricted. This may result in an escalation of privileges.
Solution
Implement the attached corrections provided in this security note to address the missing authorization checks.
Reason and prerequisites
PP-MES does not contain authorization checks for verifying an authenticated user’s authorization to access certain functions. This may lead to undesired system behavior. In Release 605, this issue can occur starting from Support-Package SAPKH60504.
Full note on SAP: SAP Support Launchpad note 1593247
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].