Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
Производитель ПО
Наименование ПО
SAP Notes
(1492988-5)
SAP Support Packages
(SAPKB46B62, SAPKB46C61, SAPKB62069, SAPKB64027, SAPKB70023, SAPKB70108, SAPKB70205, SAPKB71011, SAPKB71106, SAPKB72004, SAPKB73001, SAPKH31IB9, SAPKH40B89, SAPKH45B67)
Описание
Transaction RZ11 distinguishes between the SAP system and customer systems, since customers must not change profile parameter attributes. For this reason, the maintenance options are not visible in customer systems.
However, for emergency corrections, it may be required to change a profile parameter. For this, a user could enter an undocumented OK code. This procedure has now been classified as relevant for security, and is therefore adjusted. In addition, an authorization check was integrated. Users who are not authorized can only display the profile parameters, but cannot change these parameters.
However, for emergency corrections, it may be required to change a profile parameter. For this, a user could enter an undocumented OK code. This procedure has now been classified as relevant for security, and is therefore adjusted. In addition, an authorization check was integrated. Users who are not authorized can only display the profile parameters, but cannot change these parameters.
Как исправить
The system checks for the authorization object 'S_ADMI_FCD' ID 'S_ADMI_FCD' FIELD 'PADM'.
If the user does not have this authorization object, the user can only display data. Changes are not possible.
An authorized user can access the maintenance mode via 'Go To -> Maintenance Mode' and make the necessary changes.
In addition, the user can switch profile values dynamically if this is supported in this release.
------------------------------------------------------------------------
|Manual Post-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component SAP_APPL SAP Application |
| Release 31I Until SAPKH31IB8 |
| Release 40B Until SAPKH40B88 |
| Release 45B Until SAPKH45B66 |
------------------------------------------------------------------------
In the interface status 1001 of the program RSPFLDOC, create a new 'Goto' menu with the 'Edit' menu option:
If the user does not have this authorization object, the user can only display data. Changes are not possible.
An authorized user can access the maintenance mode via 'Go To -> Maintenance Mode' and make the necessary changes.
In addition, the user can switch profile values dynamically if this is supported in this release.
------------------------------------------------------------------------
|Manual Post-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component SAP_APPL SAP Application |
| Release 31I Until SAPKH31IB8 |
| Release 40B Until SAPKH40B88 |
| Release 45B Until SAPKH45B66 |
------------------------------------------------------------------------
In the interface status 1001 of the program RSPFLDOC, create a new 'Goto' menu with the 'Edit' menu option:
Ссылки
