SAP Security Note
HotNews
SAP security note 1531669, “Missing Authorization Check”, is a program error note released on 01.03.2011. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
An authenticated user can utilize functionality of a special and obsolete workbench to which access should be restricted. This can potentially result in an escalation of privileges.
Solution
The obsolete function modules and reports are invalidated. To address this issue:
- Import the specified Support Package: refer to Support Package SAPKA70024 or the relevant version for your system.
- Manual Corrections: implement the corrections as per the provided correction instructions if applicable to your Support Package level.
Reason and prerequisites
Some obsolete function modules and reports lack permission checks for an authenticated user’s authorization to access certain functionalities. This may lead to undesired system behavior.
References
This note refers to
- SAP Note 888889 – Automatic checks for security notes using RSECNOTE (outdated)
Referenced by
Affected components
- CA-GTF-TS-GMA (Cross-Application Components > General Application Functions > Technical Application Support > Generation, monitoring, mass data archiving)
- SAP_ABA 700 to 730
Full note on SAP: SAP Support Launchpad note 1531669
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
