Freight Order Auth. check incorrectly executed, SAP security note 1548672

SAP Note 1548672
SAP Security Note

SAP security note 1548672, "Freight Order: Auth. check incorrectly executed", released on 08.03.2011. Below are the symptom and SAP recommended solution.

ComponentTransportation Management (Basic Functions > Authorization Check)

TypeSAP Security Note

StatusReleased for Customer

Released on08.03.2011

Description

Symptom

The existing authorization check in Freight Order Management is executed with incorrect attributes. This flaw allows an unauthenticated user to access Freight Order Management functions that should be restricted, potentially leading to privilege escalation.

Solution

Implement the attached source code corrections provided in SAP Note 1548672.

Reason and prerequisites

The current authorization check utilizes data that may not be accurate in all scenarios. As a result, users might gain access to and execute functions on certain documents without proper authorization.

CVSS

Score 0

References

SAP Note 1522754: SAP TM 8.0 – Collection of Notes, Pro-active Implementation

Full note on SAP: SAP Support Launchpad note 1548672

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#Authorization Check #Transportation Management #Freight Order #Privilege escalation