SAP security note 1465917, “Check table for the Table Provider in the PLM UI framework.” Below are the symptom and SAP recommended solution.
Description
Symptom
This SAP Security Note addresses unpermitted RFC access to tables within the PLM UI framework. A class method delivered with Enhancement Package 4 allows reading any table via RFC using the table provider class, potentially granting unauthorized access.
Solution
Restrict the read capability of the table provider class to only Customizing tables specifically listed in a system table. Implement the corrections as per the correction instructions provided in the note.
Reason and prerequisites
The table provider class’s read capability is not properly restricted, enabling access to any table via RFC.
Full note on SAP: SAP Support Launchpad note 1465917
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
