Missing authorization check in Batch Input Recorder, SAP security note 1979454

SAP security note 1979454, "Missing authorization check in Batch Input Recorder", is a note. Below are the symptom and SAP recommended solution.

Description

Symptom

An authenticated user can use functions of Batch Input Recorder to which access should be restricted. This may result in an escalation of privileges.

Solution

Please apply the Support Package mentioned in this SAP Note or the correction instruction.

By the correction, an authorization check for S_BDC_MONI is introduced in transaction SHDB. The performance of this authorization check depends on the system profile parameter ‘bdc/shdb/auth_check’. Set the value of this system profile parameter to ‘TRUE’ to enable the newly introduced authorization check.

Reason and prerequisites

Batch Input Recorder does not contain authorization checks for checking an authenticated user’s authorization to access some of its functions. This may result in undesired system behavior.

CVSS

Score 6.5 Vector: AV:N/AC:L/AU:S/C:P/I:P/A:P

References