SAP Note 2503107
SAP Security Note
Medium priority
SAP Security Note
Medium priority
SAP security note 2503107, "Missing authorization checks in PM-WOC-MO", is a note released on 20.10.2017. Below are the symptom and SAP recommended solution.
Description
Symptom
EAM order management does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.
- Abuse functionality restricted to a particular user group
- Read, modify, or delete restricted data
Solution
Implement additional authority checks by following the correction instructions.
Reason and prerequisites
Missing authorization check.
References
- 1101670 – Mass changes to order: change authorization is ignored I
- 1552769 – Mass change of order operations
Full note on SAP: SAP Support Launchpad note 2503107
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
