Missing authorization check in SE30 “Tips & Tricks”, SAP security note 1661349

SAP security note 1661349, “Missing authorization check in SE30 "Tips & Tricks"”, is a note released on 14.02.2012. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

An authenticated user can use functions of SE30 “Tips & Tricks” to which access should be restricted. This may result in an escalation of privileges.

Solution

Please apply the support package mentioned in this note at least, or the respective correction instruction.

Reason and prerequisites

SE30 “Tips & Tricks” does not contain authorization checks for verifying an authenticated user’s authorization to access some of its functions. This may result in undesired system behavior.

CVSS

Score 6.1 Vector: AV:N/AC:H/AU:S/C:P/I:P/A:C

Affected components

• SAP_BASIS (46C to 46D, 610 to 640, 700 to 702, 710 to 730, 731)