Security Note Security gap in ACO_BSP_ADMIN II, SAP security note 1515424

SAP security note 1515424, "Security Note: Security gap in ACO_BSP_ADMIN II", is a note. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

In the BSP application ACO_BSP_ADMIN, it is possible to change the search help URL to any search help that exists in the system. This exposes a security gap allowing unauthorized alterations.

Solution

This security note enhances the solution provided in Note 1229303 (refer to the "cProjects 3.x" section in Note 1229303). The solution is also applicable to version 4.0 if the BSP application ACO_BSP_ADMIN is still in use.

• Create a new data structure: using transaction SE11, create the structure DPR_TS_BSP_APPL ("List of cProjects BSP applications") with components NAME (CHAR32) and KURZTEXT (CHAR128), set Enhancement Category to "Can Be Enhanced, Character-Type or Numeric-Type", and activate the structure.
• Create a new table type: in transaction SE11, create the table type DPR_TT_BSP_APPL ("List of BSP applications – table type") with Line Type DPR_TS_BSP_APPL and Access set to Standard Table.
• Update JavaScript: applicable for SAP_ABA 620/640 or, below 700, the script cannot be replaced automatically due to the Support Package level. Use transaction SE80 to replace the MIME object Search.js in the BSP application PLM_SHLP with the source code provided in the attached Search.zip, and reset the browser cache after updating.
• Implement the correction instructions detailed in this note.

Affected components

• CPROJECTS versions 300 and 310_620 to 310_640
• CPRXRPM version 400