SAP Security Note
Low priority
SAP security note 1428998, "Missing authority check in Demand Planning transaction", is a program error note released on 15.02.2010. Below are the symptom and SAP recommended solution.
Description
Symptom
In general when starting a transaction, authorization checks are executed to verify that the user can access the transaction. Sometimes transactions are called during program execution. In that case, the program should execute the authorization check itself before calling the transaction.
In this note, authorization checks are added when programs are starting the transactions SE18 for BADI maintenance and /SAPAPO/MC96B for forecast profile maintenance.
Solution
Implement this note or relevant support package.
References
This note refers to
Full note on SAP: SAP Support Launchpad note 1428998
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
