SAP security note 1922547, “Missing authentication check in NW EP iView Wizard”. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
An unauthenticated user can use functions of the new iView wizard component to which access should be restricted. This may result in an escalation of privileges.
Solution
The code fix implements an authentication check to verify a user’s access to the new iView wizard functions.
Install the patch listed in the SAP Patch Level tab to resolve this issue.
Reason and prerequisites
NW Portal’s new iView wizard component does not contain authentication checks for verifying a user’s access to some of its functions. This may result in undesired system behavior.
CVSS
Score 6.4 Vector: AV:N/AC:L/AU:N/C:P/I:P/A:N
References
Affected components
- EP-PIN-WD (Enterprise Portal > SAP Enterprise Portal (On Premise) > Use other comp.), version 7.00
Full note on SAP: SAP Support Launchpad note 1922547
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].