SAP Note 2281095
SAP Security Note
SAP Security Note
SAP security note 2281095, "Missing authorization check in ECTR", released on March 30, 2016. Below are the symptom and SAP recommended solution.
Description
Symptom
An authenticated user can use functions of ECTR to which access should be restricted. This may result in an escalation of privileges.
Solution
Implement this SAP Security Note to enforce proper authorization checks within ECTR.
Reason and prerequisites
ECTR does not contain authorization checks for verifying an authenticated user’s permissions to access certain functions. This omission may lead to undesired system behavior.
Full note on SAP: SAP Support Launchpad note 2281095
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
