RZ11 – Maintenance Mode, SAP security note 1492988

SAP security note 1492988, "RZ11 – Maintenance Mode". Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

This security note has been updated. Detailed information is available in security note 1519936.

An undocumented OK code in transaction RZ11 allows users to change profile parameter definitions.

Solution

The system now checks for the authorization object S_ADMI_FCD with ID S_ADMI_FCD and FIELD PADM.

• Unauthorized users can only display profile parameter data; modifications are not permitted.
• Authorized users can access maintenance mode via Go To > Maintenance Mode to make necessary changes; if supported in the release, users can also dynamically switch profile values.

Reason and prerequisites

Transaction RZ11 distinguishes between the SAP system and customer systems, ensuring that customers cannot change profile parameter attributes. Consequently, the maintenance options are not visible in customer systems.

However, for emergency corrections, it may be necessary to change a profile parameter. Previously, a user could enter an undocumented OK code to perform such changes. This procedure has now been classified as a security concern and has been adjusted. An authorization check has been integrated so that users without the necessary permissions can only view profile parameters but cannot modify them.

References

• Generic search does not work in transaction RZ11
• Update #1 for Security Note 1492988

Affected components

• SAP_APPL (31I, 40B, 45B)
• SAP_BASIS (46B to 46D, 620 to 640, 700 to 730)