SAP security note 2037976, "SACO: No authorization check on Sales Organization", is a note. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
The report Scheduling Agreement Copy (SACO) permits users who are not authorized for a specific sales organization (VKORG) or document type (AUART) to execute the copying of agreements. Although an authorization check for the document type is performed, its results are not being properly considered, allowing unauthorized access.
Solution
Implement the provided corrections to address the missing authorization checks. The solution includes both automated support package updates and manual activities.
- Apply Support Packages: Ensure your system is updated with the relevant support packages listed in the note.
- Manual Activities: Follow the detailed manual steps provided in the note to revise text elements, create new sub-objects, and enhance function modules as necessary. These instructions are crucial for the proper implementation of the security fixes.
CVSS
Score 4.9 Vector: AV:N/AC:M/AU:S/C:P/I:P/A:N
References
Affected components
- IS-A-ESD (Industry-Specific Components > Automotive > Enhancements SD)
- ECC-DIMP 602 to 617
Full note on SAP: SAP Support Launchpad note 2037976
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
