Missing authorization check for transactions, SAP security note 1548210

SAP security note 1548210, "Missing authorization check for transactions", is a program error note released on 12.07.2011. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

An authenticated user can use functions of arbitrary transactions to which access should be restricted. This may result in an escalation of privileges.

Solution

Import the relevant Support Package or implement the correction instructions for the relevant release.

Reason and prerequisites

Transactions do not contain authorization checks for checking an authenticated user’s authorization to access some of their functions. This may result in undesired system behavior.

References

• 888889 – Automatic checks for security notes using RSECNOTE (outdated)

Affected components

• SAP_BASIS (46C, 620 to 640, 700 to 702, 710 to 730)