SAP Note 1597256
Medium priority
Medium priority
SAP security note 1597256, "Missing authorization check in SCM-APO-FCS-MAP", is a note released on 08.01.2013. Below are the symptom and SAP recommended solution.
Description
Symptom
An authenticated user can use functions of SCM-APO-FCS-MAP to which access should be restricted. This may result in an escalation of privileges.
Solution
Implement this security note to add the necessary authorization checks.
Reason and prerequisites
SCM-APO-FCS-MAP lacks authorization checks for certain functions, potentially leading to undesired system behavior.
CVSS
Score 4.9 Vector: AV:N/AC:M/AU:S/C:N/I:P/A:P
References
This note refers to
- SAP Note 888889 regarding automatic checks for security notes using RSECNOTE (outdated).
Full note on SAP: SAP Support Launchpad note 1597256
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
