Missing authorization check in in package SICM, SAP security note 1842406

SAP security note 1842406, “Missing authorization check in in package SICM”, is a program error note released on 11.06.2013. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

An authenticated user can use functions of package SICM to which access should be restricted. This may result in an escalation of privileges.

Solution

Install the Support Package on your system or implement the corresponding correction instruction.

Reason and prerequisites

Objects in package SICM do not contain authorization checks for verifying an authenticated user’s authorization to access some of its functions. This may result in undesired system behavior.

CVSS

Score 3.5 Vector: AV:N/AC:M/AU:S/C:N/I:N/A:P

References

• 888889 – Automatic checks for security notes using RSECNOTE (outdated)

Affected components

• SAP_BASIS 702: 702 to 702
• SAP_BASIS 710: 710 to 730
• SAP_BASIS 731: 731 to 731
• SAP_BASIS 740: 740 to 740