Missing authorization check in profile maintenance module, SAP security note 1591146

SAP security note 1591146, "Missing authorization check in profile maintenance module". Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

An authorization check is missing in the profile maintenance module.

An authenticated user can use functions of profile maintenance to which access should be restricted. This may result in an escalation of privileges.

Solution

To address this issue, import the relevant Support Package specified in this note or implement the provided correction instructions.

Reason and prerequisites

The profile maintenance does not contain authorization checks for verifying an authenticated user’s authorization to access certain functions. This oversight may lead to undesired system behavior.

CVSS

Score 3.5 Vector: AV:N/AC:M/AU:S/C:P/I:N/A:N

References

• SAP Note 888889 – Automatic checks for security notes using RSECNOTE (outdated)

Affected components

• SAP_APPL 31I, 40B, 45B
• SAP_BASIS 46B to 46D, 610 to 640, 700 to 702, 710 to 730