SAP Security Note
High priority
SAP security note 1482989, "Missing authorization check in master data transaction", is a program error note released on 14.12.2010. Below are the symptom and the SAP recommended solution.
Description
Symptom
During the maintenance of organizational data using master data transactions, the user that is logged on can call certain functions without having the authorization that is actually required for this. As a result, authorizations may be enhanced.
Solution
The correction of this error is provided in the relevant Support Package. Use the attached correction instructions to implement an advance correction.
Reason and prerequisites
In certain situations, the system may no longer perform the required authorization checks during the maintenance of organizational data. This may result in an unrequired change of the system behavior. This error occurs only if Embedded Search search connectors are created for searching in Talent Management.
Full note on SAP: SAP Support Launchpad note 1482989
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].