Missing whitelist check in LE-WM-VAS LE-TRM and LE-YM, SAP security note 2133144

SAP security note 2133144, “Missing whitelist check in LE-WM-VAS LE-TRM and LE-YM”, is a program error note released on 23.03.2016. Below are the symptom and SAP recommended solution.

Description

Symptom

An authenticated user can use functions of LE-WM-VAS LE-TRM and LE-YM to which access should be restricted. The missing check may result in undesired system behavior.

Solution

Implement the provided support package or apply the correction instructions included in this note.

Reason and prerequisites

Before applying the correction instructions in this note, you must implement Note 1487337 – Downporting the class CL_ABAP_DYN_PRG.

LE-WM-VAS LE-TRM and LE-YM do not contain required checks against a positive set of allowed functions (i.e., whitelist) during the execution of these functions. This is necessary to verify that authenticated users are permitted to access these functions.

References

• 1487337 – Downporting the class CL_ABAP_DYN_PRG