Missing authorization check in BW-PLA-BPC-ADM, SAP security note 2228520

SAP security note 2228520, "Missing Authorization Check in BW-PLA-BPC-ADM". Below are the symptom and SAP recommended solution.

Description

Symptom

Authenticated users can access restricted functions in BW-PLA-BPC-ADM, risking unauthorized privilege escalation.

Solution

Apply the following Support Packages to address the issue:

• SAP BW 7.40: Import Support Package 14 for SAP BW 7.40 (SAPKW74014). Available upon release of SAP Note 2207824 titled "Preliminary Version SAPBWNews NW BW 7.4 ABAP SP14."
• SAP BW 7.50: Import Support Package 2 for SAP BW 7.50 (SAPK-75002INSAPBW). Available upon release of SAP Note 2220381 titled "Preliminary Version SAPBWNews NW BW 7.50 ABAP SP2."

Reason and prerequisites

BW-PLA-BPC-ADM lacks necessary authorization checks for certain functions, which may cause unauthorized access and undesired system behavior.