Skip links
Arpine Maghakyan

Arpine Maghakyan

Security Researcher of RedRays.

PFCG Authorization maintenance for object S_RFCACL, SAP security note 1416085


Every RFC function call requires a logon to the called system. As long as the RFC connection was defined as trust (transaction SM59, “Logon & Security” tab page), the target system checks in addition to the S_RFC for the requested function an authorization for the object S_RCFACL. For which user these checks are carried out depends on the definition in the RFC connection.
Entries in the fields RFC_SYSID, RFC_CLIENT or RFC_USER to S_RFCACL define from which systems, clients, or for which user IDs logons to the target system are accepted. If you enter the full authorization (*) in one or more of these three fields, you allow the logon from any system, client, or any user, and as a result, you may produce significant security risks.

Available fix and Supported packages

  • SAP_BASIS | 46C | 46C
  • SAP_BASIS | 620 | 640
  • SAP_BASIS | 700 | 702
  • SAP_BASIS | 710 | 730
  • SAP_BASIS | 731 | 731
  • SAP_BASIS 720 | SAPKB72008 |
  • SAP_BASIS 730 | SAPKB73009 |
  • SAP_BASIS 620 | SAPKB62074 |
  • SAP_BASIS 46C | SAPKB46C66 |
  • SAP_BASIS 640 | SAPKB64032 |
  • SAP_BASIS 700 | SAPKB70029 |
  • SAP_BASIS 731 | SAPKB73107 |
  • SAP_BASIS 710 | SAPKB71017 |
  • SAP_BASIS 701 | SAPKB70114 |
  • SAP_BASIS 711 | SAPKB71112 |
  • SAP_BASIS 702 | SAPKB70214 |

Affected component

    ABAP Authorization and Role Administration


Score: 0


Exploit is not available.
For detailed information please contact the mail [email protected].




More to explorer

SAP Security For All

RedRays Security Platform for Penetration testers and Bug hunters

The product package is specifically created for cyber security experts who have encountered SAP while participating in bug bounty programs.

RedRays Security Platform for SAP Consultants

The product package is designed for SAP consultants conducting security assessments of SAP ERP systems. We provide essential tools and resources to help professionals in this field conduct their work effectively.

RedRays Security Platform for Enterprises

The product package is specifically optimized to cater to the needs of both small/medium and large companies who are seeking to streamline the process of organizing a comprehensive security system for ERP systems.