Skip links
Vahagn Vardanian

Vahagn Vardanian

Co-founder and CTO of RedRays

PI SEC Missing authorization check in PI Adapter Framework, SAP security note 1659874

Description

An authenticated user who is assigned to role SAP_XI_APPL_SERV_USER can use functions of PI Integration Directory or PI Enterprise Services Repository to which access should be restricted. This may result in an escalation of privileges.

Available fix and Supported packages

  • SAP_XIESR | 7.10 | 7.11
  • SAP_XIESR | 7.20 | 7.20
  • SAP_XIESR | 7.30 | 7.30
  • SAP_XIESR | 7.31 | 7.31
  • SAP_XITOOL | 3.0 | 3.0
  • SAP_XITOOL | 7.00 | 7.02
  • SAP_XITOOL | 7.10 | 7.11
  • SAP_XITOOL | 7.20 | 7.20
  • SAP_XITOOL | 7.30 | 7.30
  • SAP_XITOOL | 7.31 | 7.31
  • SAP_XIAF | 3.0 | 3.0
  • SAP_XIAF | 7.00 | 7.02
  • SAP_XIAF | 7.10 | 7.11
  • SAP_XIAF | 7.20 | 7.20
  • SAP_XIAF | 7.30 | 7.30
  • SAP_XIAF | 7.31 | 7.31
  • ESR 7.10 | SP012 | 000014
  • ESR 7.10 | SP013 | 000015
  • ESR 7.10 | SP014 | 000013
  • ESR 7.10 | SP015 | 000012
  • ESR 7.10 | SP016 | 000000
  • ESR 7.11 | SP007 | 000010
  • ESR 7.11 | SP008 | 000019
  • ESR 7.11 | SP009 | 000005
  • ESR 7.11 | SP010 | 000002
  • ESR 7.11 | SP011 | 000000
  • ESR 7.20 | SP005 | 000004
  • ESR 7.20 | SP006 | 000003
  • ESR 7.20 | SP007 | 000002
  • ESR 7.20 | SP008 | 000000
  • ESR 7.30 | SP002 | 000015
  • ESR 7.30 | SP003 | 000011
  • ESR 7.30 | SP004 | 000009
  • ESR 7.30 | SP005 | 000016
  • ESR 7.30 | SP007 | 000004
  • ESR 7.30 | SP008 | 000000

Affected component

    BC-XI-CON-AFW
    J2EE Adapter Framework

CVSS

Score: 0

PoC

Detailed vulnerability information added to RedRays Security Platform. Contact [email protected] for details.

URL

https://launchpad.support.sap.com/#/notes/1659874

TAGS

#Authorization
#authorization-check
#Process-Integration
#Advanced-Adapter-Engine-Extended
#Process-Integration-and-Orchestration-Package

Explore More

Special offer for SAP Security Udemy course!

$ 9.99

Join “SAP Security Core Concepts and Security Administration” which is part of the Blackhat course series.