Hard-coded credentials in Function Builder, SAP security note 1589919

SAP security note 1589919, "Hard-coded credentials in Function Builder", is a note. Below are the symptom and SAP recommended solution.

Description

Symptom

Unauthorized access to Function Builder, allowing potential privilege escalation.

Solution

Please apply the support package mentioned in this note at least, or follow the respective correction instructions.

Reason and prerequisites

The vulnerability is caused by an option to suppress authorization checks against developer permissions in the program’s source code. A malicious user can log on to the system and create ABAP function modules without having been assigned legitimate access by the system administrator. If a user already has privileges to log on, an escalation of privileges may be possible.

CVSS

Score 3.5 Vector: AV:N/AC:M/AU:S/C:N/I:P/A:N

References

• SAP Note 1980618 – Change in Authorization Check of RS_FUNCTIONMODULE_INSERT
• SAP Note 1826448 – Change in Authorization Check of RS_FUNCTIONMODULE_INSERT
• SAP Note 888889 – Automatic checks for security notes using RSECNOTE (outdated)