Missing authorization check in the monitor for real-time data acquisition (RDA), SAP security note 2185273

SAP security note 2185273, "Missing authorization check in the monitor for real-time data acquisition (RDA)". Below are the symptom, SAP recommended solution, CVSS score and the affected software components.

Description

Symptom

An authenticated user can use functions in the monitor for real-time data acquisition (RDA) to which access should be restricted. This may result in an escalation of privileges.

Solution

SAP BW 7.40: Import Support Package 13 for SAP BW 7.40 (SAPKW74013) into your BW system. The Support Package will be available as soon as SAP Note 2176288 with the short text "Preliminary Version SAPBWNews NW BW 7.4 ABAP SP13", which describes this Support Package in more detail, is released for customers.

In urgent cases, you can use the correction instructions.

Before you use the correction instructions, make sure that you check SAP Note 1668882 for transaction SNOTE.

This SAP Note might already be available before the Support Package is released. In this case, however, the short text still contains the term "preliminary version".

Reason and prerequisites

The monitor for real-time data acquisition (RDA) does not contain sufficient authorization checks for verifying an authenticated user's authorization to access some of its functions. This may result in undesired system behavior.

CVSS

Score 0

References

Affected components

• SAP_BW 740