SAP Security Note
Medium priority
SAP security note 1902402, "Missing whitelist check in CRM-FM-ACL", is a program error note released on 12.11.2013. Below are the symptom and SAP recommended solution.
Description
Symptom
An authenticated user can use functions of CRM-FM-ACL to which access should be restricted. This may result in an escalation of privileges.
Solution
Implement the necessary support packages or follow the correction instructions provided in this security note to ensure that whitelist checks are enforced within CRM-FM-ACL.
Reason and prerequisites
CRM-FM-ACL does not perform required checks against a whitelist of allowed functions during execution. This omission allows authenticated users to access functions they should be restricted from, potentially leading to unauthorized actions and undesired system behavior.
CVSS
Score 6.0 Vector: AV:N/AC:M/AU:S/C:P/I:P/A:P
Full note on SAP: SAP Support Launchpad note 1902402
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].