Missing authorization check in ABAP Report Variants, SAP security note 1838854

SAP security note 1838854, "Missing authorization check in ABAP Report Variants", is a program error note released on 09.12.2014. Below are the symptom and SAP recommended solution.

Description

Symptom

An authenticated user can use functions of ABAP Report variants to which access should be restricted. This may result in an escalation of privileges.

Solution

Please apply the Support Package mentioned in this SAP Note or the respective correction instruction.

The authorization check for execution of reports (S_PROGRAM) associated with an authorization group (TRDIR-SECU) has been made stricter. For a rare subset of specifically configured reports, the authorization check was not executed in specific submit scenarios, as the authorization was supposed to be performed by the calling program. This behavior has not been changed, validating the authority group also in this specific call scenario.

Reason and prerequisites

ABAP Report variants do not contain authorization checks for checking an authenticated user’s authorization to access some of its functions. This may result in undesired system behavior.

CVSS

Score 6.5 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P