Protecting data against change to destination authorization, SAP security note 1640531

SAP security note 1640531, "Protecting data against change to destination authorization". Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

An attacker can modify the authorization check for destination maintenance without initializing critical security data (e.g., passwords).

Solution

To mitigate this vulnerability, you should:

• Import the relevant Support Package: apply the appropriate Support Package corresponding to your SAP_BASIS version.
• Implement correction instructions: follow the detailed correction instructions provided in the note to manually create the necessary ABAP Dictionary structures and messages.

References

• 2132461 – RFC/HTTP Destination API checks are incompatible

Affected components

• BC-MID-RFC (Basis Components > Middleware > RFC): 700 to 740