Protect read access to tables having certificates, SAP security note 1590651

SAP security note 1590651, "Protect read access to tables having certificates", is a program error note released on 30.05.2016. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

Insufficient authority checks may allow read access to tables containing HTTP signatures. A user who has authorization to SE16 can download the certificate, use it to sign URLs, and gain access to secured archive data.

Solution

Please follow the manual steps below to remove the display/maintenance authorizations or import the corrections via Support Package:

• Go to transaction SE11.
• Enter the table name CREP_CERT.
• Click on the Change button.
• Click on the Delivery and Maintenance tab.
• Change the attribute Data Browser/Table View Maint. to Display/Maintenance not allowed.

Reason and prerequisites

These tables have the delivery and maintenance attribute set as ‘display/maintenance allowed with restrictions’.

CVSS

Score 2.1 Vector: AV:N/AC:H/AU:S/C:P/I:N/A:N

Affected components

• SAP_BASIS (620 to 640)
• SAP_BASIS (700 to 702)
• SAP_BASIS (710 to 730)
• SAP_BASIS (731 to 731)
• SAP_BASIS (800 to 803)