Missing authorization check in ABAP Program Editor, SAP security note 1596907

SAP security note 1596907, “Missing authorization check in ABAP Program Editor”, is a program error note released on 20.07.2012. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

An authenticated user can use functions of the ABAP Program Editor to which access should be restricted. This may result in an escalation of privileges.

Solution

Please apply the support package mentioned in this note at least, or the respective correction instruction.

Reason and prerequisites

This security note replaces Security Note 1012066 for all affected versions.

CVSS

Score 4.6 Vector: AV:N/AC:H/AU:S/C:P/I:P/A:P

Affected components

• SAP_BASIS: 46C, 620 to 640, 700 to 702