Missing authorization check in application “Edit System Log and Security Audit Log Messages”, SAP security note 1926485

SAP security note 1926485, "Missing authorization check in application "Edit System Log and Security Audit Log Messages"". Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

An authenticated user can use functions of transaction SE92 to which access should be restricted by the object S_DEVELOP. This may result in an escalation of privileges.

Solution

• Restrict Access to SE92: The usage of transaction SE92 is rarely needed in customer environments. To prevent unwanted access to that transaction, you can lock it using transaction SM01. This lock can be transported with object entry R3TR TRAN SE92.
• Register Modifications: Changes to log event definitions are connected to the SSCR (after the implementation of note 1673767). A user must register modifications to these objects at the service marketplace. This helps restrict and identify unwanted changes.
• Implement Correction: Apply the attached correction via SNOTE or a support package. With this fix, the transaction SE92 checks activities on event definitions using the object S_DEVELOP (Objecttype: SYAG, Objectname <event class>, and Activity: Change, Display, Delete). If a correction for your version is unavailable, use the workaround to lock SE92.

Reason and prerequisites

SE92 does not contain authorization checks for verifying an authenticated user’s authorization to access its log event definitions. This may result in undesired system behavior.

CVSS

Score 3.6 Vector: AV:N/AC:H/AU:S/C:N/I:P/A:P