Missing authorization check in BW-BEX-OT-OLAP, SAP security note 1863815

SAP security note 1863815, "Missing authorization check in BW-BEX-OT-OLAP", is a program error note released on 13.08.2013. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

An authenticated user can use functions of BW-BEX-OT-OLAP to which access should be restricted. This may result in an escalation of privileges.

Solution

To address this issue, import the appropriate Support Package for your SAP NetWeaver BW version:

• SAP NetWeaver BW 7.00: Import Support Package 31 (SAPKW70031)
• SAP NetWeaver BW 7.01 (EHP 1): Import Support Package 14 (SAPKW70114)
• SAP NetWeaver BW 7.02 (EHP 2): Import Support Package 14 (SAPKW70214)
• SAP NetWeaver BW 7.11: Import Support Package 12 (SAPKW71112)
• SAP NetWeaver BW 7.30: Import Support Package 10 (SAPKW73010)
• SAP NetWeaver BW 7.31 (EHP 1): Import Support Package 9 (SAPKW73109)
• SAP NetWeaver BW 7.40: Import Support Package 4 (SAPKW74004)

For urgent cases, you can apply the correction instructions available here. Before proceeding, ensure you review SAP Note 1668882 for transaction SNOTE.

Reason and prerequisites

BW-BEX-OT-OLAP does not contain authorization checks for verifying an authenticated user’s permissions to access certain functions. This lack of checks can lead to undesired system behavior and potential security breaches.

Affected components

• SAP_BW: Versions 700 to 702, 711 to 730, 731 to 731, 740 to 740
• SAP_BW_VIRTUAL_COMP: Version 701