Missing authorization checks in ST-PI, SAP security note 1727914

SAP security note 1727914, "Missing authorization checks in ST-PI", is a program error note released on 14.08.2012. Below are the symptom, CVSS score, reason, SAP recommended solution, references and the affected software components.

Description

Symptom

An authenticated user can use functions remotely to which access should be restricted. This may result in an escalation of privileges.

Solution

Apply the correction as detailed in the correction instructions.

Reason and prerequisites

ST-PI does not contain authorization checks for verifying an authenticated user’s permissions to access certain functions. This may result in undesired system behavior.

CVSS

Score 7.5 Vector: AV:N/AC:M/AU:S/C:P/I:P/A:C

References

Affected components

• ST-PI 2008_1_620
• ST-PI 2008_1_640
• ST-PI 2008_1_700
• ST-PI 2008_1_710