search

SAP-samples / security-services-tools

If you use security-related services and tools such as EWA, SOS, System Recommendations, Configuration Validation, or a security dashboard in SAP Solution Manager, the ABAP reports in this repository can help with further analysis and development.
Apache License 2.0
46 stars 9 forks source link

CVA check for security-services-tools #19

Open danielpreiser opened 1 year ago

danielpreiser commented 1 year ago

Hi Frank,

just a question out of curiosity:

Are all the provided reports being checked for vulnerabilities using the Code Vulnerability Analyzer? We implemented some of the SolMan reports and had some findings related to that. I am aware that probably not all checks are of serious attention, but some like "Missing authority check in ABAP report" should be considered. Right?

Thanks in advance for the response! BR Daniel

FrankBuchholz commented 1 year ago

Hi Daniel,

Yes, I agree, I should run the CVA on all reports again. Which reports showed findings in your case?

I know that report ZSHOW_GWMON_LOG has a finding about the file name which gets read via OPEN DATASET which is not easy to solve. The log file names are not based on direct user input but on the value of profile parameters, therefore, I ignored that finding so far.

Greetings Frank