Privilege Escalation in PP-BD-RTG, SAP security note 1852955

SAP Note 1852955
SAP Security Note
High priority

SAP security note 1852955, "Privilege Escalation in PP-BD-RTG", is released on August 13, 2013. Below are the symptom and SAP recommended solution.

ComponentProduction Planning and Control > Basic Data > Routing (PP-BD-RTG)

PriorityCorrection with high priority

TypeSAP Security Note

Version4

StatusReleased for Customer

Released onAugust 13, 2013

Description

Symptom

Function module in PP-BD-RTG does not contain authorization checks for verifying an authenticated user’s authorization to access certain functions. This may result in an escalation of privileges.

Solution

Implement this SAP note to address the vulnerability.

Reason and prerequisites

The lack of authorization checks in the function module can lead to undesired system behavior, potentially allowing unauthorized privilege escalation.

CVSS

Score 4.6 Vector: AV:N/AC:H/AU:S/C:P/I:P/A:P

Full note on SAP: SAP Support Launchpad note 1852955

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#PP-BD-RTG #Routing #Privilege Escalation #Authorization Check