Security gap in mass maintenance, SAP security note 304394

SAP Note 304394
SAP Security Note
Medium priority

SAP security note 304394, "Security gap in Mass Maintenance", is a note released on October 8, 2009. Below are the symptom and the SAP recommended solution.

PriorityMedium priority

TypeSAP Security Note

Version2

StatusReleased for Customer

Released onOctober 8, 2009

Description

Symptom

Within the mass maintenance, you can use ABAP FORM routines. These routines allow you to make changes in the system or display data.

Solution

Implement the attached program corrections.
Additionally, implement the advanced correction from SAP Note 445892.

After applying these corrections, the system will require authorization S_DEVELOP for the entry of ABAP source code.

Reason and prerequisites

There is a gap in the authorization check of the mass maintenance feature.

Full note on SAP: SAP Support Launchpad note 304394

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#MASS #authority check #mass maintenance