SAP Security Note
Medium priority
SAP security note 1629242, "Missing cross tenant authorization check in LOD-ESO-AS", is a program error note released on 12.06.2012. Below are the symptom and SAP recommended solution.
Description
Symptom
An authenticated user can use functions of LOD-ESO-AS belonging to another tenant and thus access should be restricted. This may result in an escalation of privileges.
Solution
Fixes have been developed and released in Version 5.0 J, Version 5.1 Patch 10, and all Version 7.0 SP and patch releases. Update to the appropriate Release/Patch version to mitigate this risk.
Reason and prerequisites
LOD-ESO-AS does not contain authorization checks for verifying an authenticated user’s authorization to access cross tenant functions. This may result in undesired system behavior.
Full note on SAP: SAP Support Launchpad note 1629242
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].