SAP Security Note
High priority
SAP security note 1431615, "User-defined message search: Authorization for test", is a program error note released on 09.02.2010. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
You use the user-defined message search (transaction SXMS_LMS_CONF); in particular, you use the test functions to check whether your extractors are correct. In addition to the existing authorization checks, you also want to have the option to use an authorization object to control the view of the extracts from the payload.
Solution
Implement the correction instructions or import the Support Package specified below. As of now, you can use the same authorization object as you use in message monitoring to control the display of the extracted data from the payload of the message.
Reason and prerequisites
This function is missing in the releases listed.
References
This note refers to
Affected components
- SAP_BASIS (711 to 711)
Full note on SAP: SAP Support Launchpad note 1431615
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].