Skip links

Security note Authorization check when executing reports, SAP security note 1012066

Description

This security note is obsolete and replaced with security note 1596907.

1.) You can use transaction SE38 or transaction SE80 to execute an executable program (report) in the standard SAP system if you have display or change authorization and if the report is not assigned to any authorization group.

2.) If you use any navigation steps to display an executable program, you can use the menu option “Program -> Execute” to execute the program as long as it is not assigned to an authorization group.

3.) If you use any navigation steps to display an executable program, you can use the context menu of the object list of the object browser to execute the program, provided it is not assigned to an authorization group.

Example of this type of navigation:
a) You call transaction SE09 and display a request that contains an executable program. If you have display or change authorization, you can double-click to navigate to the program in display mode. If the program is not assigned to an authorization group, you can execute this program.

b) You call transaction ST22 and display a dump. From there, you can display the program if you have display or change authorization.
You can execute this program if it is an executable program and is not assigned to an authorization group.

Examples a) and b) depict just two navigation options. In the ABAP Workbench, there are even more ways in which you can navigate to display a program. This note applies to all of these navigation cases.

Available fix and Supported packages

  • SAP_BASIS | 46B | 46C
  • SAP_BASIS | 610 | 640
  • SAP_BASIS | 700 | 702
  • SAP_BASIS | 710 | 730
  • SAP_BASIS 46B | SAPKB46B62 |
  • SAP_BASIS 640 | SAPKB64020 |
  • SAP_BASIS 620 | SAPKB62062 |
  • SAP_BASIS 700 | SAPKB70012 |
  • SAP_BASIS 46C | SAPKB46C55 |
  • SAP_BASIS 702 | SAPKB70205 |
  • SAP_BASIS 710 | SAPKB71011 |
  • SAP_BASIS 46C | SAPKB46C61 |
  • SAP_BASIS 711 | SAPKB71106 |
  • SAP_BASIS 620 | SAPKB62069 |
  • SAP_BASIS 720 | SAPKB72004 |
  • SAP_BASIS 640 | SAPKB64027 |
  • SAP_BASIS 700 | SAPKB70023 |
  • SAP_BASIS 701 | SAPKB70108 |
  • SAP_BASIS 730 | SAPKB73001 |

Affected component

    BC-DWB-TOO-ABA
    ABAP Editor

CVSS

Score: 0

PoC

Detailed vulnerability information added to RedRays Security Platform. Contact [email protected] for details.

URL

https://launchpad.support.sap.com/#/notes/1012066

TAGS

#

Udemy SAP Security Course.

Join “SAP Security Core Concepts and Security Administration” which is part of the Blackhat course series. This course will help you master SAP security fundamentals, from securing SAP environments to managing user access and addressing vulnerabilities. It is ideal for IT professionals and SAP administrators, providing practical skills to safeguard critical business assets. Whether you’re a beginner or an expert looking to deepen your SAP security knowledge, this course is perfect for you.

More to explorer

SAP Hash Cracking Techniques

Understanding Hash Cracking Hashing is a one-way encryption technique employed to ensure data integrity, authenticate information, and secure passwords alongside other sensitive

SAP Security Patch Day – September 2024

As the second Tuesday of September 2024 approaches, SAP administrators and security professionals are preparing for another crucial event: SAP Security Patch

Special offer for SAP Security Udemy course!

$ 9.99

Join “SAP Security Core Concepts and Security Administration” which is part of the Blackhat course series.