Security note Files transferrable to EPS inbox w/o auth., SAP security note 1330776

SAP security note 1330776, "Security note: Files transferrable to EPS inbox w/o auth.", is a note. Below are the symptom, SAP recommended solution and reason and prerequisites.

Description

Symptom

Due to a missing authorization check in an RFC-enabled function module, if certain prerequisites are met, you can place files in the EPS inbox without authorization.

Solution

Import the Support Package or implement the correction instructions. If you cannot do this or if this takes a long time, you can also set the directory <transport directory>/EPS/in to read-only. If you want to import Support Packages or perform upgrades, you must provide this directory with write authorization for the SAP system.

Reason and prerequisites

This problem is caused by a program error.

References

• 888889 – Automatic checks for security notes using RSECNOTE (outdated)