SAP security note 1950021, "Missing authorization check in Web Dynpro ABAP". Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
An authenticated user can use functions of Web Dynpro ABAP to which access should be restricted. This may result in an escalation of privileges.
Solution
Apply the relevant service pack or correction instructions to address the missing authorization checks.
Reason and prerequisites
Web Dynpro ABAP does not contain authorization checks for verifying an authenticated user’s authorization to access certain functions. This may lead to undesired system behavior.
Affected components
- SAP_UI 740
- SAP_BASIS 700 to 731
Full note on SAP: SAP Support Launchpad note 1950021
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
