ALE Missing authorization check in ALE monitoring tool, SAP security note 1536491

SAP security note 1536491, "ALE: Missing authorization check in ALE monitoring tool", is released on 08.02.2011. Below are the symptom and SAP recommended solution.

Description

Symptom

An authenticated user can use functions in ALE or CCMS monitoring to which access should be restricted. This may result in an escalation of privileges.

Solution

• Implement Correction Instructions: Use the Note Assistant to apply the correction instructions provided in the note.
• Import Support Package: Alternatively, import the relevant Support Package to address the issue.

Reason and prerequisites

The ALE or CCMS monitoring lacks permission checks for an authenticated user’s authorization to access some of its functionality. This may result in undesired system behavior.

References

• SAP Note 888889 – Automatic checks for security notes using RSECNOTE (outdated)