Security Note Check for ‘System -> Status’ (SE80), SAP security note 1085326

SAP security note 1085326, "Security Note: Check for ‘System -> Status’ (SE80)", was released on April 23, 2012. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

This security note addresses an issue where the system does not properly check authorization for transaction code SE80 (authorization object S_TCODE). Specifically, users without the appropriate authorization can navigate to the Technical Information from various points within the SAP GUI, potentially exposing sensitive system information.

• Users can access Technical Information without proper authorization via menu System -> Status…
• Users can access Technical Information via the F1 Help modal window, using the F9 button, the ‘Technical Information’ option in the context menu, or the ‘Technical Information’ button on the F1 Help screen.
• Users can access Technical Information via the ‘Technical Information’ button in the Performance Assistant.
• Double-clicking allows access to selected Workbench objects even if the ABAP Workbench (SE80) authorization is not assigned.

Solution

• Implement the corrections using the Note Assistant or import the relevant Support Package.
• After applying the corrections, users without authorization for SE80 cannot navigate to Technical Information.
• To verify the fix, create a user without SE80 authorization and attempt the steps outlined above.

Reason and prerequisites

The system fails to check transaction code SE80 properly, allowing unauthorized access.

References

• Security Note 1706461
• No navigation from "Technical Information" in SE80
• SE80 authorization check in RS_TOOL_ACCESS
• Automatic checks for security notes using RSECNOTE (outdated)

Affected components

• SAP_APPL: Versions 31I, 40B, 45B
• SAP_BASIS: Versions 46B to 46D, 610 to 640, 700, 710