SAP security note 1658530, "Missing authorization check in remote security". Below are the symptom and SAP recommended solution.
Description
Symptom
An authenticated user can use functions of the remote security component to which access should be restricted. This may result in an escalation of privileges.
Solution
The fix is available in the versions of the Web AS Java detailed in the "SP Patch Level" section of the note.
Reason and prerequisites
The remote security component does not contain sufficient authorization checks for verifying an authenticated user’s authorization to access certain functions. This may lead to undesired system behavior.
Full note on SAP: SAP Support Launchpad note 1658530
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].