CO-OM Tools SE16N Adapting to SE16, SAP security note 1115699

SAP security note 1115699, "CO-OM Tools: SE16N: Adapting to SE16", is a program error note released on 07.05.2010. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

Executing a function module directly via SE37 bypasses the standard authorization checks that are enforced when the module is accessed through the intended transaction.

The SE16N transaction menu contains unnecessary branches for the current environment.

An additional transaction ‘N’ redirects to SE16N, creating potential security concerns.

Solution

• Implement program changes: Modify SE16N modules to enforce identical authorization checks as those in the SE16N transaction. Apply the program changes provided in the Support Packages linked to this note. Manual tasks are required for ERP Release 603 and are not included in the Support Packages.
• Remove transaction code ‘N’: Use transaction SE93 to delete the transaction code ‘N’.
• Clean up SE16N menu: Navigate to transaction SE80 for the function group ‘SE16N’. Expand ‘GUI Status’ and edit status ‘0100’. Remove unnecessary menu entries by deleting specific menu codes. Activate the updated status to apply changes.

Reason and prerequisites

Function modules are designed to perform specific processing tasks within a transaction, with authorization checks typically handled by the calling transaction. However, released modules callable by customer programs may bypass these checks, leading to unauthorized access or operations.

CVSS

Score 0

References

Affected components

• SAP_APPL 470
• SAP_APPL 500
• SAP_APPL 600
• SAP_APPL 602
• SAP_APPL 603