GWI SAP DB access restriction, SAP security note 1425455

SAP security note 1425455, "GWI: SAP DB Access Restriction", is a note. Below are the symptom and SAP recommended solution.

Description

Symptom

A malicious user can exploit the data persisted by the system.

Solution

Please implement the following steps manually.

DDIC changes:

• Go to transaction SE11, table GWI_PROPERTIES. In the menu, select Utilities > Assign Authorization Group. Change the authorization field value to ‘CRMC’.
• Go to transaction SE11, table GWI_SYNC_PROFILE. In the menu, select Utilities > Assign Authorization Group. Add new entries (available in change mode). Table: GWI_SYNC_PROFILE. Authorization: CRMC.
• Go to transaction SE11, table GWI_SYNC_PROF_T. In the menu, select Utilities > Assign Authorization Group. Add new entries (available in change mode). Table: GWI_SYNC_PROF_T. Authorization: CRMC.
• Go to transaction SE11, table GWI_SYNC_PROP. In the menu, select Utilities > Assign Authorization Group. Add new entries (available in change mode). Table: GWI_SYNC_PROP. Authorization: CRMC.
• Go to transaction SE11, table GWI_SYNC_PROP_T. In the menu, select Utilities > Assign Authorization Group. Add new entries (available in change mode). Table: GWI_SYNC_PROP_T. Authorization: CRMC.
• Go to transaction SE11, table GWI_SYNC_PROPDEF. In the menu, select Utilities > Assign Authorization Group. Add new entries (available in change mode). Table: GWI_SYNC_PROPDEF. Authorization: CRMC.

Reason and prerequisites

Extended authorization protection was missing for tables belonging to Client side Groupware Integration.