Missing whitelist check in PY-CH, SAP security note 1868012

SAP security note 1868012, "Missing whitelist check in PY-CH", is a program error note released on 09.07.2013. Below are the symptom and SAP recommended solution.

Description

Symptom

An authenticated user can use functions of PY-CH to which access should be restricted. This may result in an escalation of privileges.

Solution

Implement support package or correction instructions.

Reason and prerequisites

PY-CH does not contain required checks against a positive set of allowed functions (i.e., whitelist) during the execution of these functions. This is required to verify that authenticated users are allowed to access these functions. The missing check may result in undesired system behavior.

CVSS

Score 6.0 Vector: AV:N/AC:M/AU:S/C:P/I:P/A:P