Missing authorization check in PDS_MAINT, SAP security note 1835666

SAP security note 1835666, “Missing authorization check in PDS_MAINT”, released on June 11, 2013. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

An authenticated user can use functions of PDS_MAINT to which access should be restricted. This may result in an escalation of privileges.

Solution

Implement this note by following the steps below:

• Transaction SE24: change class CL_PDS_MAINT_CONTROL and define a new parameter IV_VERID (Importing, Optional, Type: VERID) for method AUTHORITY_CHECK; define new static public Boolean attributes GV_DISPLAY_HEAD and GV_CHANGE_HEAD.
• Class CL_PDS_READ_DATA: repeat the same attribute definition steps as above.
• Transaction SE91: change message class PDS_MAINT and define new messages: 025 No authorization to display header data; 026 No authorization to change operation data; 027 No authorization to change header data.
• Activate all of these changes if not done already.

Reason and prerequisites

PDS_MAINT does not contain authorization checks for verifying an authenticated user’s authorization to access some of its functions. This may result in undesired system behavior.

CVSS

Score 6.0 Vector: AV:N/AC:M/AU:S/C:P/I:P/A:P

Affected components

• SAP_APPL: Releases 600 to 617
• PI: From 2004_1_46C to 2004_1_500