SAP Note 1504485
SAP security note 1504485, "Missing Authorization Check in CRM-MKT-MPL". Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
An authenticated user can use functionality of CRM-MKT-MPL to which access should be restricted. This can potentially result in an escalation of privileges.
Solution
Apply the SAP Note using the SNOTE transaction or download it directly.
WarningYou must perform this manual activity separately in each system into which you transport the Note for implementation. Corrections are only needed in release 7.01. Refer to the validity section to identify the relevant Support Package in 7.01 and follow the correction instructions accordingly.
Reason and prerequisites
CRM-MKT-MPL lacks permission checks for an authenticated user’s authorization to access some of its functionality. This may result in undesired system behavior.
Affected components
- BBPCRM – Customer Relationship Management > Marketing > Marketing Planner
Full note on SAP: SAP Support Launchpad note 1504485
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].