Skip links
🔥🔥🔥 Join us for our upcoming training session at Black Hat MEA: "Securing SAP Systems: Expert Insights and Penetration Testing Techniques" 🛡️🔍

Security note Authorization check when executing reports, SAP security note 1012066

Description

This security note is obsolete and replaced with security note 1596907.

1.) You can use transaction SE38 or transaction SE80 to execute an executable program (report) in the standard SAP system if you have display or change authorization and if the report is not assigned to any authorization group.

2.) If you use any navigation steps to display an executable program, you can use the menu option “Program -> Execute” to execute the program as long as it is not assigned to an authorization group.

3.) If you use any navigation steps to display an executable program, you can use the context menu of the object list of the object browser to execute the program, provided it is not assigned to an authorization group.

Example of this type of navigation:
a) You call transaction SE09 and display a request that contains an executable program. If you have display or change authorization, you can double-click to navigate to the program in display mode. If the program is not assigned to an authorization group, you can execute this program.

b) You call transaction ST22 and display a dump. From there, you can display the program if you have display or change authorization.
You can execute this program if it is an executable program and is not assigned to an authorization group.

Examples a) and b) depict just two navigation options. In the ABAP Workbench, there are even more ways in which you can navigate to display a program. This note applies to all of these navigation cases.

Available fix and Supported packages

  • SAP_BASIS | 46B | 46C
  • SAP_BASIS | 610 | 640
  • SAP_BASIS | 700 | 702
  • SAP_BASIS | 710 | 730
  • SAP_BASIS 46B | SAPKB46B62 |
  • SAP_BASIS 640 | SAPKB64020 |
  • SAP_BASIS 620 | SAPKB62062 |
  • SAP_BASIS 700 | SAPKB70012 |
  • SAP_BASIS 46C | SAPKB46C55 |
  • SAP_BASIS 702 | SAPKB70205 |
  • SAP_BASIS 710 | SAPKB71011 |
  • SAP_BASIS 46C | SAPKB46C61 |
  • SAP_BASIS 711 | SAPKB71106 |
  • SAP_BASIS 620 | SAPKB62069 |
  • SAP_BASIS 720 | SAPKB72004 |
  • SAP_BASIS 640 | SAPKB64027 |
  • SAP_BASIS 700 | SAPKB70023 |
  • SAP_BASIS 701 | SAPKB70108 |
  • SAP_BASIS 730 | SAPKB73001 |

Affected component

    BC-DWB-TOO-ABA
    ABAP Editor

CVSS

Score: 0

Exploit

Detailed vulnerability information added to RedRays Security Platform. Contact [email protected] for details.

URL

https://launchpad.support.sap.com/#/notes/1012066

TAGS

#

How to detect over 4100 vulnerabilities in SAP Systems?

More to explorer