Missing authorization check in BAdI Framework, SAP security note 1916550

SAP security note 1916550, “Missing authorization check in BAdI Framework”, released on 12.11.2013. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

An authenticated user can use functions of the BAdI Framework to which access should be restricted. This may result in an escalation of privileges.

Solution

The report ENH_DEL_RUNTIME_DATA has been improved by adding an authorization check for S_DEVELOP. Please apply the support package mentioned in this note or follow the respective correction instructions.

Reason and prerequisites

The BAdI Framework does not contain authorization checks for verifying an authenticated user’s authorization to access certain functions. This oversight may lead to undesired system behavior.

Affected components

• SAP_BASIS (700 to 702, 710 to 730, 731, 740)