Skip links
Arpine Maghakyan

Arpine Maghakyan

Security Researcher of RedRays.

Authorization for testing, SAP security note 591395


Existing authorizations in roles and profiles that contain the discreet activity ’03’ (“Display”) no longer authorize users to execute development objects.
However, if a full authorization (‘*’) for the activity is contained in authorizations for the S_DEVELOP authorization object, the behavior does not change because the full authorization also includes the new activity ’16’ (“Execute”).
Activity ’16’ (“Execute”) is already defined for the S_DEVELOP authorization object in all releases as of Release 4.0B.
Therefore, you do not need to adjust the authorization object.

Available fix and Supported packages

  • SAP_BASIS | 640 | 640

Affected component

    Workbench Tools: Editors, Painter, Modeler


Score: 0


Detailed vulnerability information added to RedRays Security Platform. Contact [email protected] for details.




More to explorer

SAP Cloud Connector Certificate Validation Issue

Date of Release: February 13, 2024 Advisory ID: CVE-2024-25642 Affected Software: SAP Cloud Connector Versions Affected: 2.15.0 to 2.16.1 Vulnerability Summary:A critical vulnerability,

Protect Your SAP with RedRays Security Platform

Explore the Power of Our Scanner with an Interactive Prototype Below