Missing authorization check in a BW report, SAP security note 1414059

SAP security note 1414059, "Missing authorization check in a BW report". Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

A missing authorization check in an older BW report allows unauthorized changes to BW, potentially leading to system instability and security risks. Users with the ability to execute certain programs can make undetected data changes, endangering data security and system stability.

Solution

• SAP NetWeaver BW 7.00: Import Support Package 24 (SAPKW70024). Refer to Note 1407598 "SAPBINews NW BI 7.0 ABAP SP24".
• SAP NetWeaver BW 7.01: Import Support Package 07 (SAPKW70107). Refer to Note 1369294 "SAPBINews NW BI 7.01 ABAP SP07".
• SAP NetWeaver BW 7.02: Import Support Package 03 (SAPKW70203). Refer to Note 1407600 "SAPBINews NW BI 7.02 ABAP SP03".
• SAP NetWeaver BW 7.10: Import Support Package 08 (SAPKW71008). Refer to Note 1260071 "SAPBINews NW BI 7.10 ABAP SP08".
• SAP NetWeaver BW 7.11: Import Support Package 05 (SAPKW71105). Refer to Note 1392372 "SAPBINews NW BI 7.11 ABAP SP05".
• SAP NetWeaver BW 7.20: Import Support Package 03 (SAPKW72003). Refer to Note 1407599 "SAPBINews NW BI 7.2 ABAP SP03".
• SAP BW 3.0B and BW 3.10 Content: Implement the attached correction instructions. Refer to Note 1414059.
• SAP BW 3.50: Import Support Package 26 (SAPKW35026). Refer to Note 1398391 "SAPBWNews BW Support Package 26 NetWeaver ’04 Stack 26".
• SAP BW 2.0B / BW 2.10 Content: Implement the attached correction instructions.

Implementing this note removes the critical source code without substitution. It does not pose any risk to your system.

Affected components

• SAP NetWeaver BW 2.X, 3.X, 7.X (specific support packages listed above)
• SAP BW Releases 3.0B, 3.10, 3.50, 2.0B, 2.10