SAP Security Note
High priority
SAP security note 787151, “Starting transactions from ABAP documentation is unprotected”, is a program error note released on 08.10.2009. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
You can call certain transactions from the ABAP keyword documentation display without the authorization to start the transaction being checked.
Comment: The other authorization checks for the transactions run as expected.
Solution
Import a Support Package or implement the correction instructions.
Once you have implemented the correction, the authorization check at the start of the transaction is checked against the S_TCODE authorization object, even when you call a transaction from the ABAP keyword documentation.
Affected components
- SAP_BASIS (46C to 46D)
- SAP_BASIS (610 to 640)
Full note on SAP: SAP Support Launchpad note 787151
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].