Missing authorization check in SCM-APO-INT-MD-PDS, SAP security note 2214442

SAP Note 2214442
SAP Security Note
Medium priority

SAP security note 2214442, "Missing authorization check in SCM-APO-INT-MD-PDS", is a program error note released on January 21, 2016. Below are the symptom and SAP recommended solution.

CategoryProgram error

PriorityCorrection with medium priority

TypeSAP Security Note

StatusReleased for Customer

Released onJanuary 21, 2016

Description

Symptom

An authenticated user can use functions of SCM-APO-INT-MD-PDS to which access should be restricted. This may result in an escalation of privileges.

Solution

Implement SAP Security Note 2214442 to add the necessary authorization checks within SCM-APO-INT-MD-PDS.

Reason and prerequisites

Without proper authorization checks in SCM-APO-INT-MD-PDS, unauthorized users could access restricted functions, potentially leading to privilege escalation and undesired system behavior.

Full note on SAP: SAP Support Launchpad note 2214442

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#SCM-APO-INT-MD-PDS #Authorization Check #Privilege Escalation