Security Issue with standard profile S_CSMREG, SAP security note 1593885

SAP security note 1593885, "Security Issue with standard profile S_CSMREG", is a consulting note released on July 12, 2011. Below are the symptom and SAP recommended solution.

Description

Symptom

An authenticated user can use functions of ST-PI to which access should be restricted. This may result in an escalation of privileges.

Solution

Delete the existing profile S_CSMREG in your system. Follow the steps as described in SAP Note 1572183 for user READ (READ – RFC).

The profile adaption will be delivered with ST-PI 2008_1_700 SP05.

Reason and prerequisites

ST-PI contains authorization checks for checking an authenticated user’s authorization to access some of its functions. This may result in undesired system behavior.