SAP Security Note
High priority
SAP security note 1672344, "Wrong setup of security policy profile when creating a user", is a program error note released on 12.06.2012. Below are the symptom and SAP recommended solution.
Description
Symptom
When creating and managing users concerning security policy profiles, an incorrect (predefined) security policy profile might be set for the user. The issue can occur in the following scenarios:
- Creating a user in the useradmin application.
- Creating a user with the UME API.
- Creating a user in a self-registration scenario.
- Managing user data in the useradmin application or UME API.
Solution
Update your AS Java to a Support Package or release where the issue is fixed. See the "Support Package Patch Level" section below for details and available patches.
Reason and prerequisites
The incorrect behavior is caused by a bug in the UME functionality.
Full note on SAP: SAP Support Launchpad note 1672344
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
