Missing authorization check in WD ABAP Tracing Tool, SAP security note 1660446

SAP security note 1660446, “Missing authorization check in WD ABAP Tracing Tool”, is released on March 13, 2012. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

An authenticated user can use functions of the WebDynpro ABAP Tracing Tool to which access should be restricted. This may result in an escalation of privileges.

Solution

Please implement the attached correction instruction or the corresponding support package.

Reason and prerequisites

WebDynpro ABAP does not contain authorization checks for verifying an authenticated user’s authorization to access certain functions. This may lead to undesired system behavior.

References

• SAP Note 1699407: SAP TM 9.0-Collection of notes recommended to be implemented
• SAP Note 888889: Automatic checks for security notes using RSECNOTE (outdated)

Affected components

• SAP_BASIS 731