Missing authorization check in function modules of BW-SYS-DB-DB4, SAP security note 1974016

SAP security note 1974016, “Missing authorization check in function modules of BW-SYS-DB-DB4”, is a note released on 15.02.2018. Below are the symptom and SAP recommended solution.

Description

Symptom

The function modules in function group BW-SYS-DB-DB4 are defined as remote-enabled but lack authorization checks to restrict their access.

Solution

To address this issue, import the appropriate Support Package based on your SAP BW version:

• SAP NetWeaver BW 7.00 – Import Support Package 33 (SAPKW70033)
• SAP NetWeaver BW 7.01 (SAP NW BW 7.0 EHP 1) – Import Support Package 16 (SAPKW70116)
• SAP NetWeaver BW 7.02 (SAP NW BW 7.0 EHP 2) – Import Support Package 16 (SAPKW70216)
• SAP NetWeaver BW 7.11 – Import Support Package 14 (SAPKW71114)
• SAP NetWeaver BW 7.30 – Import Support Package 12 (SAPKW73012)
• SAP NetWeaver BW 7.31 (SAP NW BW 7.3 EnhP 1) – Import Support Package 12 (SAPKW73112)
• SAP NetWeaver BW 7.40 – Import Support Package 7 (SAPKW74007)

Before importing the Support Packages, review SAP Note 1668882 for transaction SNOTE.

Reason and prerequisites

The affected function modules provide remote access to information in a SAP BW system running on the IBM i platform, enabling consistency checks based on SAP BW guidelines for such platforms. Although the access was read-only, the absence of authorization checks poses a security risk.

CVSS

Score 6.3 Vector: AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L