SAP Security Note
Medium priority
SAP security note 1806435, "Missing Authorization Check in BW-EI-RTR," is a note released on 12.03.2013. Below are the symptom, SAP recommended solution and the reason and prerequisites.
Description
Symptom
An authenticated user can use functions of BW-BCT-RTR to which access should be restricted. This may result in an escalation of privileges.
Solution
Implement the attached fix or apply the corresponding support package.
Reason and prerequisites
BW-BCT-RTR does not contain authorization checks for checking an authenticated user’s authorization to access some of its functions. This may result in undesired system behavior.
CVSS
Score 4.7 Vector: AV:N/AC:L/AU:M/C:P/I:N/A:P
Full note on SAP: SAP Support Launchpad note 1806435
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
