Missing authorization check in BW-SYS-DB, SAP security note 2044018

SAP security note 2044018, “Missing authorization check in BW-SYS-DB”, was released on 15.09.2017. Below are the symptom and the SAP recommended solution.

Description

Symptom

An authenticated user can access functions of BW-SYS-DB even though access to these functions should be restricted. This can result in an escalation of privileges.

Solution

To resolve the issue, import the following Support Packages into your BW system:

• SAP Business Warehouse (SAP BW) 7.0: Import Support Package 34 for SAP BW 7.00 (SAPKW70034).
• SAP BW 7.01 (EHP1): Import Support Package 17 for SAP BW 7.01 (SAPKW70117).
• SAP BW 7.02 (EHP2): Import Support Package 17 for SAP BW 7.02 (SAPKW70217).
• SAP BW 7.11: Import Support Package 14 for SAP BW 7.11 (SAPKW71114).
• SAP BW 7.30: Import Support Package 13 for SAP BW 7.30 (SAPKW73013).
• SAP BW 7.31 (EHP1): Import Support Package 15 for SAP BW 7.31 (SAPKW73115).
• SAP BW 7.40: Import Support Package 10 for SAP BW 7.40 (SAPKW74010).

Reason and prerequisites

BW-SYS-DB does not contain authorization checks for verifying an authenticated user’s authorization to access certain functions. This omission can lead to undesired system behavior.