SAP security note 1265043, "S_TCODE Authority check on T000 by SM30". Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
A user without authorization to access the table T000 can maintain the same via the transaction SM30 or any transaction that calls the table T000 through view maintenance.
Solution
Implement the following correction instructions and follow the manual steps provided in the note.
For each applicable Software Component Release, perform the following steps:
- STEP 1: TA: SE54 for table T000.
- STEP 2: Select the ‘Generated Objects’ radio button and click on the ‘create/change’ tab.
- STEP 3: Navigate via menu ‘Environment – Modification – Events’.
- STEP 4: In the Events screen, click on “New entries”.
- STEP 5: Add the new event “CHECK_AUTHORITY_SCC4” with Event Number 25.
- STEP 6: Press Enter.
- STEP 7: Save the event by clicking on the save tab.
Reason and prerequisites
The issue arises due to a missing authority check that should be performed every time the view T000 is accessed via view maintenance.
References
This note refers to
- 888889 – Automatic checks for security notes using RSECNOTE (outdated)
Referenced by
- 888889 – Automatic checks for security notes using RSECNOTE (outdated)
Affected components
- SAP_APPL: Release 45B
- SAP_BASIS: Releases 46C, 46D, 620, 640, 700, 701, 710, 711
Full note on SAP: SAP Support Launchpad note 1265043
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].