Prohibit changing browsed vendor master data, SAP security note 1489519

SAP security note 1489519, "Prohibit changing browsed vendor master data", released on March 8, 2011. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

This SAP Security Note addresses a vulnerability that allows authenticated users to alter Vendor Master Data, potentially leading to privilege escalation within the SAP system.

• Unauthorized Modifications: Users with access can make unauthorized changes to Vendor Master Data.
• Privilege Escalation: These changes can result in elevated privileges, compromising system security.
• Data Integrity Risks: Unauthorized access and modifications threaten the integrity of critical business data.

Solution

Review and adjust authorizations: restrict authorization object S_TABU_DIS for table authorization groups FA and WA (activities 02=change and 03=display); use transaction SUIM to identify and remove these authorizations from users, roles, or profiles as necessary.

Restrict access to transaction SE16: limit user permissions for transaction SE16 to prevent unauthorized data browsing and manipulation.

Implement the following manual correction instructions to secure tables LFM1 and LFM2:

• Modify table maintenance settings in SE11: go to transaction SE11, enter table name LFM1 or LFM2, navigate to the Delivery and Maintenance tab, and change the Data Browser/Table View Maintenance (DD02D-MAINFLAG) from ‘X’ (Display/Maintenance allowed) to ‘ ‘ (Display/Maintenance allowed with restrictions).
• WarningActivating tables LFM1 and LFM2 can impact system performance.

  Schedule the re-activation during periods of low or no system activity to prevent transaction failures.

Affected components

• SAP_APPL – releases 31I, 40B, 45B, 46B, 46C, 470, 500, 600, 602, 603, 604, 605