Missing authorization check in BW-WHM-DBA, SAP security note 2064501

SAP security note 2064501, "Missing authorization check in BW-WHM-DBA". Below are the symptom and SAP recommended solution.

Description

Symptom

An authenticated user can use functions of BW-WHM-DBA to which access should be restricted. This may result in an escalation of privileges.

Solution

To address this issue, apply the following Support Packages based on your SAP BW version:

• SAP BW 7.01 (EHP 1): Import Support Package 18 (SAPKW70118) into your BW system. Available with SAP Note 2123573 titled "SAPBINews NW7.01 BW ABAP SP18".
• SAP BW 7.02 (EHP 2): Import Support Package 18 (SAPKW70218) into your BW system. Available with SAP Note 2126275 titled "Preliminary Version SAPBWNews NW BW 7.02 ABAP SP18".
• SAP BW 7.30: Import Support Package 14 (SAPKW73014) into your BW system. Available with SAP Note 2132939 titled "SAPBWNews NW7.30 BW ABAP SP14".
• SAP BW 7.31 (EHP 1): Import Support Package 17 (SAPKW73117) into your BW system. Available with SAP Note 2139356 titled "Preliminary Version SAPBWNews NW BW 7.31/7.03 ABAP SP17".
• SAP BW 7.40: Import Support Package 12 (SAPKW74012) into your BW system. Available with SAP Note 2143705 titled "Preliminary Version SAPBWNews NW BW 7.4 ABAP SP12".

Reason and prerequisites

BW-WHM-DBA does not contain authorization checks for verifying an authenticated user’s authorization to access certain functions, potentially leading to undesired system behavior.