Skip links
RedRays - Your SAP Security Solution
Picture of Vahagn Vardanian

Vahagn Vardanian

Co-founder and CTO of RedRays

SAP Security on Udemy

Missing authorization check in RMA, SAP security note 1469845

SAP Note 1469845
SAP Security Note
Medium priority

SAP security note 1469845, "Missing authorization check in RMA", is a program error note released on July 13, 2010. Below are the symptom, SAP recommended solution and the affected software components.

ComponentEA-RETAIL
CategoryProgram error
PriorityCorrection with medium priority
TypeSAP Security Note
Version3
StatusReleased for Customer
Released onJuly 13, 2010

Description

Symptom

Certain functions of the Retail Method of Accounting (RMA) can be called without the required authorization. This may result in an escalation of privileges.

Solution

A new role SAP_ISR_RMA_ADMINISTRATOR is delivered with the following Support Package levels:

  • ECC 6.05 Support Package 02
  • ECC 6.04 Support Package 07
  • ECC 6.03 Support Package 07

Reason and prerequisites

This note is relevant only if the business function ISR_RETAIL_RMA has been activated. In the RMA, authorization checks that regulate access to functions are missing. A user that is logged on can simply call these functions without these checks, potentially leading to unauthorized changes in system behavior.

Affected components

  • EA-RETAIL 603
  • EA-RETAIL 604
  • EA-RETAIL 605

Full note on SAP: SAP Support Launchpad note 1469845

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#Authorization #authorization check #stock ledger #Retail Method of Accounting (RMA)

Explore More