Missing authorization check in BW-WHM-DST, SAP security note 1967780

SAP security note 1967780, “Missing authorization check in BW-WHM-DST”, is a program error note released on 10.06.2014. Below are the symptom and SAP recommended solution.

Description

Symptom

An authenticated user can use functions of BW-WHM-DST to which access should be restricted. This may result in an escalation of privileges.

Solution

Apply the appropriate Support Package for your SAP NetWeaver BW version:

• SAP NetWeaver BW 7.00: Import Support Package 33 (SAPKW70033). Available after SAP Note 1930762.
• SAP NetWeaver BW 7.11: Import Support Package 14 (SAPKW71114). Available after SAP Note 1940531.
• SAP NetWeaver BW 7.30: Import Support Package 12 (SAPKW73012). Available after SAP Note 1950117.
• SAP NetWeaver BW 7.31 (SAP NW BW 7.3 EnhP 1): Import Support Package 12 (SAPKW73112). Available after SAP Note 1951409.
• SAP NetWeaver BW 7.40: Import Support Package 7 (SAPKW74007). Available after SAP Note 1955499.

You can use the correction instructions of this note as long as support packages are not yet available.

Before applying the correction instructions, ensure that you check SAP Note 1668882 for transaction SNOTE.

Reason and prerequisites

BW-WHM-DST does not contain authorization checks for verifying an authenticated user’s authorization to access certain functions. This may result in undesired system behavior.

CVSS

Score 3.5 Vector: AV:N/AC:M/AU:S/C:P/I:N/A:N