Missing authorization check in SD-CAS-SP, SAP security note 2157877

SAP Note 2157877
High priority

SAP security note 2157877, "Missing authorization check in SD-CAS-SP", is a program error note released on 09.06.2015. Below are the symptom and SAP recommended solution.

CategoryProgram error

PriorityHigh priority

StatusReleased for Customer

Released on09.06.2015

Description

Symptom

An authenticated user can use functions of SD-CAS-SP to which access should be restricted. This may result in an escalation of privileges.

Solution

Implement the correction instruction provided in the note.

Reason and prerequisites

SD-CAS-SP does not contain authorization checks for verifying an authenticated user's authorization to access some of its functions. This may result in undesired system behavior.

Full note on SAP: SAP Support Launchpad note 2157877

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#Authorization #Authorization check #SD-CAS-SP