Skip links
RedRays - Your SAP Security Solution
Picture of Vahagn Vardanian

Vahagn Vardanian

Co-founder and CTO of RedRays

SAP Security on Udemy

Missing authorization check in IS-R-PUR-MPO, SAP security note 2031795

SAP Note 2031795
SAP Security Note
Medium priority

SAP security note 2031795, "Missing Authorization Check in IS-R-PUR-MPO", is a note released on 11.11.2014. Below are the symptom, SAP recommended solution and the affected software components.

ComponentIS-R-PUR-MPO (Industry-Specific Component Retail > Retail Purchasing > Mass Maintenance Purchase Orders)
PriorityCorrection with medium priority
TypeSAP Security Note
StatusReleased for Customer
Released on11.11.2014
LanguageEnglish

Description

Symptom

An authenticated user can utilize functions of the IS-R-PUR-MPO component that should have restricted access. This may lead to an escalation of privileges.

Solution

New authorization checks have been implemented to ensure proper access control within the IS-R-PUR-MPO component.

Reason and prerequisites

The IS-R-PUR-MPO component lacks necessary authorization checks to verify an authenticated user’s permissions for accessing certain functions, potentially causing undesired system behavior.

References

Affected components

  • SAP_APPL (versions 600 to 617)

Full note on SAP: SAP Support Launchpad note 2031795

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#Authorization #IS-R-PUR-MPO #Mass Maintenance Purchase Orders

Explore More