Missing authorization check in WD ABAP tracing tool, SAP security note 1555846

SAP security note 1555846, “Missing Authorization Check in WD ABAP Tracing Tool”, is a program error note released on June 14, 2011. Below are the symptom and SAP recommended solution.

Description

Symptom

An authenticated user can use functions of the Web Dynpro ABAP tracing tool to which access should be restricted. This may result in an escalation of privileges.

Due to missing authorization checks in the Web Dynpro ABAP tracing tool, unauthorized users may escalate their privileges, potentially leading to undesired system behavior and compromising system security.

Solution

Implement the correction instructions provided for this note, or import the relevant Support Package.

CVSS

Score 0

References

• Automatic checks for security notes using RSECNOTE (outdated)