Skip links
RedRays - Your SAP Security Solution
Picture of Vahagn Vardanian

Vahagn Vardanian

Co-founder and CTO of RedRays

SAP Security on Udemy

Unauthorized read-access to database, SAP security note 1496092

SAP Note 1496092
SAP Security Note
High priority

SAP security note 1496092, “Unauthorized read-access to database”, is a program error note released on 09.11.2010. Below are the symptom and the SAP recommended solution.

ComponentBasis Components > Information Lifecycle Management (ILM) > Information Retention Manager (IRM)
CategoryProgram error
PriorityCorrection with high priority
TypeSAP Security Note
Version4
StatusReleased for Customer
Released on09.11.2010
LanguageEnglish

Description

Symptom

ILM handling requires a generic access option not only for archived data but also for other data. This poses the risk of unauthorized read access to the database.

Solution

You can use an authorization rule to specify the authorized users.

Reason and prerequisites

The risk of misuse is to be avoided by restricting the potential users of the specified function to the users from the archiving environment.

References

Full note on SAP: SAP Support Launchpad note 1496092

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#Archiving #ILM #rule interpretation

Explore More