Missing authorization check in BW-BEX-ET, SAP security note 1784654

SAP security note 1784654, "Missing authorization check in BW-BEX-ET". Below are the symptom and SAP recommended solution.

Description

Symptom

An authenticated user can use functions of BW-BEX-ET to which access should be restricted. This may result in an escalation of privileges.

Solution

Apply the appropriate Support Package for your SAP NetWeaver BW version. You can use the correction instructions provided in the note.

Important: Before using the correction instructions, ensure you check SAP Note 875986 for transaction SNOTE.

Reason and prerequisites

BW-BEX-ET does not contain authorization checks for verifying an authenticated user's authorization to access certain functions. This may lead to undesired system behavior.

CVSS

Score 6.0 Vector: AV:N/AC:M/AU:S/C:P/I:P/A:P

References

• 888889 – Automatic checks for security notes using RSECNOTE (outdated)