Missing Authorization check in Transaction GTABKEY, SAP security note 2408558

SAP Note 2408558
SAP Security Note
Medium priority

SAP security note 2408558, “Missing Authorization check in Transaction GTABKEY”, is a program error note released on 14.02.2017. Below are the symptom and SAP recommended solution.

ComponentBasis Components > Change and Transport System > Workbench/Customizing Organizer (BC-CTS-ORG)

CategoryProgram error

PriorityCorrection with medium priority

TypeSAP Security Note

StatusReleased for Customer

Released on14.02.2017

LanguageEnglish

Description

Symptom

Transaction GTABKEY does not perform the necessary authorization checks for an authenticated user, resulting in escalation of privileges.

Abuse of functionality restricted to a particular user group
Ability to read, modify, or delete restricted data

Solution

The correction introduces an authority check on S_TCODE before calling transactions.

Please apply the relevant Support Package mentioned in this SAP Note or follow the correction instructions.

Full note on SAP: SAP Support Launchpad note 2408558

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#Access control #Authorization error #Authorization profile