Missing Authorization Check in WDA demo application, SAP security note 1517358

SAP security note 1517358, "Missing Authorization Check in WDA demo application". Below are the symptom and SAP recommended solution.

Description

Symptom

An authenticated user can use functionality of a Web Dynpro demo application to which access should be restricted. This can potentially result in an Escalation of Privileges.

Solution

• Option 1: Use transaction SICF to deactivate the SICF node /sap/bc/webdynpro/sap/DemoDynamic/.
• Option 2: Implement the attached correction instructions or import the relevant Support Package.

Reason and prerequisites

The Web Dynpro application lacks permission checks for an authenticated user's authorization to access some of its functionality. This may result in undesired system behavior.