Vulnerabilities in Custom ABAP Code

SAP Application & System Security White Paper

The growth of SAP since its founding in 1972 has made it the dominant ERP solution provider, globally. However, few companies can use SAP as is, and therefore must customize it to fit their business processes. With few exceptions, much of the custom ABAP code has never been subjected to rigorous code audits. Combine this with the use of outsourced custom development plus the expansion of Web applications and Web services, and the presence of unexploited vulnerabilities in ERP systems will be a certainty. Customers without in-house security code experts should consider a technical review of their code, establishment of a baseline, and remediation of code errors in mission critical and financially sensitive areas