Missing authorization check in SAP Solution Manager, SAP security note 1532042

SAP security note 1532042, “Missing authorization check in SAP Solution Manager.” Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

This Security Note has been updated. See Security Note 1604162 for further details. An authenticated user can use certain functions of SAP Solution Manager without having the required authorization. This may result in an escalation of privileges.

Solution

Import the specified Support Package or implement the attached correction instructions.

Reason and prerequisites

SAP Solution Manager does not contain authorization checks for verifying an authenticated user’s permissions to access some of its functions. This may lead to undesired system behavior.

References

• 1604162 – Update #1 for security note 1532042
• 888889 – Automatic checks for security notes using RSECNOTE (outdated)

Affected components

• Service > SAP Solution Manager > Solution Manager System Landscape (SV-SMG-SYS)