Missing Authorization Check in SAP NetWeaver ABAP Dictionary
SAP NetWeaver and ABAP Platform (ABAP Dictionary Access Control)
Extremely broad BASIS version coverage — every ABAP system from BASIS 700 to 816. The ABAP Dictionary underpins every custom development and configuration in an SAP landscape; unauthorised write access to it is not a minor misconfiguration. Schedule within two weeks.
Vulnerability Detail
Missing authorisation check in the ABAP Dictionary (BC-DWB-DIC-AC) component of SAP NetWeaver and ABAP Platform allows an authenticated attacker with low privileges to access or modify ABAP Dictionary objects beyond their intended permissions. The ABAP Dictionary is the central repository for data definitions — unauthorised write access could facilitate data manipulation or privilege escalation.
Workaround
Review and tighten S_DEVELOP and S_TABU_DIS authorisations for non-developer roles.
Patch Action
Apply SAP Note 3735546.
Affected Versions
Patch Info