Skip links
Arpine Maghakyan

Arpine Maghakyan

Security Researcher of RedRays.

Missing authorization check in segmentation service SGS, SAP security note 1514018

Description

Certain functions of Bank Analyzer Segmentation Service FS-BA-TO-SGS can be called even though the user that is logged on does not have the required authorization. This may result in an escalation of privileges.

Available fix and Supported packages

  • FSAPPL | 200 | 200
  • FSAPPL | 300 | 300
  • BANK-ALYZE | 42 | 42
  • BANK-ALYZE | 50 | 50
  • FSAPPL 200 | SAPKISC313 |
  • FSAPPL 300 | SAPK-30006INFSAPPL |
  • BANK-ALYZE 42 | SAPKIBAM14 |
  • BANK-ALYZE 50 | SAPKIBAL21 |

Affected component

    FS-BA-TO-SGS
    Segmentation Service

CVSS

Score: 0

Exploit

Exploit is not available.
For detailed information please contact the mail [email protected]

URL

https://launchpad.support.sap.com/#/notes/1514018

TAGS

#Authorization
#authorization-check
#segmentation-service-FS-BA-TO-SGS

More to explorer