Missing authority check in Data Consistency Framework, SAP security note 1409141

SAP security note 1409141, "Missing authority check in Data Consistency Framework". Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

Missing authority check in Data Consistency Framework.

Solution

Apply the correction instructions provided in this note.

Reason and prerequisites

There is a missing authority check in some transactions within the Data Consistency Framework. Code corrections need to be made in the following objects:

• RFC /OSP/DCCT_LIGHTWEIGHT: currently, this RFC does not verify if the input is provided before processing the data consistency check. This condition needs to be checked by the RFC.
• Class /OSP/CL_DCCT_LW_FACTORY, Method CREATE: this method creates an object of the default DCC class if a custom class is not implemented. This condition is no longer required.

CVSS

Score 0

References

Affected components

• SAP_BASIS (6.40, 7.00 to 7.02, 7.10 to 7.20)