Security issue gATP, SAP security note 1514989

SAP security note 1514989, "Security issue gATP", is a program error note released on 10.04.2012. Below are the symptom and SAP recommended solution.

Description

Symptom

Transportation and vehicle scheduling in the area of global availability check might use the ‘condition technique’ in order to evaluate durations. An authenticated user can use functions of ‘transportation and shipment scheduling’ to which access should be restricted. This may result in an escalation of privileges.

Solution

Import the Support Package specified in this note or implement the relevant correction instructions.

Reason and prerequisites

The condition technique of transport and shipment scheduling does not contain authorization checks for verifying an authenticated user’s authorization to access some of its functions. This may result in undesired system behavior.

CVSS

Score 0

References

• SAP Note 888889 – Automatic checks for security notes using RSECNOTE (outdated)