Missing Authorization Check in Procurement card., SAP security note 1483591

SAP security note 1483591, "Missing Authorization Check in Procurement card.", is a program error note released on January 18, 2011. Below are the symptom and SAP recommended solution.

Description

Symptom

This security note has been updated. For more detailed information, see Security Note 1526559.

An authenticated user can use functionality of the procurement card to which access should be restricted. This can potentially result in an escalation of privileges.

Affected Releases: SAP SRM 4.0, SAP SRM 5.0, SAP SRM 6.0, SAP SRM 7.0, SAP SRM 7.01.

Solution

Please implement the attached correction instructions or import the corresponding support package.

Reason and prerequisites

The procurement card lacks permission checks for an authenticated user’s authorization to access some of its functionality. This may result in undesired system behavior.