Missing authorization check in IS-B-BCA, SAP security note 2021253

SAP security note 2021253, “Missing authorization check in IS-B-BCA”, is a program error note released on 12.08.2014. Below is the security information published by SAP for this note.

Description

Symptom

An authenticated user can use functions of IS-B-BCA to which access should be restricted. This may result in an escalation of privileges.

Reason and prerequisites

IS-B-BCA does not contain authorization checks for verifying an authenticated user's authorization to access certain functions. This may result in undesired system behavior.

Solution

Apply the correction or import the relevant support package.

Manual Instructions:

1. Call transaction SE37, enter the function module name BKK_GL_AT_GET_FIDATA, and press the Change button. 2. The system displays the screen Function Builder: Change BKK_GL_AT_GET_FIDATA. Navigate to the Attributes tab. 3. In the Processing Type section, select the radio button Normal Function Module, thereby deselecting the Remote-Enabled Module radio button.