Missing authorization check in EH&S, SAP security note 1579735

SAP security note 1579735, "Missing authorization check in EH&S", is a program error note released on September 13, 2011. Below are the symptom and SAP recommended solution.

Description

Symptom

An authenticated user can use functions of EH&S to which access should be restricted. This may result in an escalation of privileges.

Solution

The "Reference to Support Packages" section specifies the Support Packages that include the necessary corrections. For information about the validity of these corrections, refer to the correction instructions.

Alternatively, you can implement the attached correction instructions.

Reason and prerequisites

EH&S does not contain authorization checks for verifying an authenticated user’s permissions to access certain functions. This oversight may lead to unintended system behavior.

References