SAP security note 1431790, "Security Fixes for SRM Legal Contract Authoring Duet Application", is a program error note released on 09.02.2010. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
The SRM Legal Contract Authoring Duet application can be exploited by a malicious user to obtain privileges beyond their current authorization levels. This vulnerability allows an attacker to impersonate another user, potentially leading to a full compromise of the application’s security, especially if an administrator account is targeted.
Solution
Implement the attached corrections or apply the appropriate support package as indicated in the note.
Reason and prerequisites
Running business logic with different user privileges is dangerous as it impairs accountability. An attacker with access to this data may impersonate another user and access information with the same rights as the target user. If an administrator is impersonated, it can lead to a complete security compromise of the application.
References
This note refers to
Affected components
- SAP SRM 6.0
- SAP SRM 7.0
Full note on SAP: SAP Support Launchpad note 1431790
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
