SAP security note 1532610, "Authorization check not working properly for TCCS". Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
The authorization check for the Transportation Charge Calculation Sheet (TCCS) is not functioning correctly. An authorization trace reveals that all authorization object fields are consistently filled with spaces. This issue can lead to the following scenarios:
- A user can display or edit instances they do not have authorization for.
- A user is prevented from displaying or editing TCCS instances they are authorized for.
These problems may result in an escalation of privileges. The authorization check for TCCS fails, allowing unauthorized access or restricting authorized access improperly.
Solution
Implement the correction as specified in the correction instructions provided with this note.
Reason and prerequisites
The authorization check for TCCS was incorrectly implemented, leading to unintended system behavior.
Affected components
- SAPTM 100
Full note on SAP: SAP Support Launchpad note 1532610
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].