Missing authority check in APO transaction., SAP security note 1235367

SAP security note 1235367, "Missing authority check in APO transaction.", is a note. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

For maintenance of planning-relevant characteristic combinations, only display and change rights can be checked (object C_APO_FUN, function S_CHARC and C_CHARC). There is no possibility to limit user rights for deletion.

Solution

A new authorization object C_APO_CVC is created with fields ACTVT and APO_PSTRU. The following activities can be set:

• Create CVCs
• Display CVCs
• Delete CVCs

This authorization object is added to the objects checked by function module /SAPAPO/MCP_PERMISSION_CHECK2.

The behavior of characteristic combination maintenance won’t change if the new object C_APO_CVC is not assigned to any user, since the original object C_APO_FUN with function S_CHARC/C_CHARC is still checked. Additionally, the new object C_APO_CVC is also checked.

Note 1262016 has been created to check C_APO_CVC at other points where users might be able to maintain CVCs.

If the system doesn’t allow creating the new authorization object (SAP namespace), you can import the attached files (102842.zip contains K102842.A3P and R102842.A3P) that contain the authorization object. The procedure is described in Note 13719.

Reason and prerequisites

It might be useful to limit user rights for deletion of CVCs.

CVSS

Score 0

References

Affected components

• SCM: 410
• SCM: 500
• SCM: 510
• SCM: 700