Missing Authorization check in SCM, SAP security note 1486833

SAP security note 1486833, "Missing Authorization check in SCM". Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

An authenticated user can use functionality to which access should be restricted. This can potentially result in an escalation of privileges.

Solution

The role /SAPAPO/DP_SUPERUSER is obsolete and must be replaced by the role SAP_SCM_FCS_PLN_ADM. Additionally, this role should be manually adapted.

Implement the support package or execute the following manual steps:

For Role SAP_SCM_INTEGRATION:

• Go to transaction PFCG.
• Enter the role SAP_SCM_INTEGRATION and click the “Change” button.
• Navigate to the “Authorizations” tab.
• Click “Change Authorization Data”.
• Expand “Cross-application Authorization Objects”.
• Select “Transaction Code Check at Transaction Start” and press the remove button.
• Click the delete button (trash can symbol) and confirm.
• Return to the main screen of transaction PFCG, enter the role SAP_SCM_INTEGRATION, and press the transport button.
• Ensure “Also Transport generated profiles for Single Roles” is active.
• Execute and continue through the dialog boxes, activating “Personalization” when prompted.
• Complete the transport.

For Role /SAPAPO/DP_SUPERUSER:

• Go to transaction PFCG.
• Enter the role /SAPAPO/DP_SUPERUSER and click the “Change” button.
• Navigate to the “Authorizations” tab.
• Click “Change Authorization Data”.
• Expand “Cross-application Authorization Objects”.
• Deactivate the entries for “Transaction Code Check at Transaction Start” with the value “All transactions”.
• Click the delete button (trash can symbol) and confirm.
• Return to the main screen of transaction PFCG, enter the role /SAPAPO/DP_SUPERUSER, and press the transport button.
• Ensure “Also Transport generated profiles for Single Roles” is active.
• Execute and continue through the dialog boxes, activating “Personalization” when prompted.
• Select a transport and transport the role.
• Exit the transaction.

Reason and prerequisites

Roles SAP_SCM_INTEGRATION and /SAPAPO/DP_SUPERUSER lack permission checks for an authenticated user’s authorization to access some of their functionalities. This may result in undesired system behavior.

Affected components

• Supply Chain Management > Advanced Planning and Optimization > Interfaces (SCM-APO-INT)