Skip links
Arpine Maghakyan

Arpine Maghakyan

Security Researcher of RedRays.

Location Authorization Check for Planning Version, SAP security note 1294675

Description

When maintaining planning version dependend location data in transaction /SAPAPO/LOC3 there is no authorization check on the planning version. It is not checked wether the user has the authorization to maintain the version dependend data.

Available fix and Supported packages

  • SAP_APO | 30A | 30A
  • SAP_APO | 310 | 310
  • SCM | 400 | 400
  • SCM | 410 | 410
  • SCM | 500 | 500
  • SCM_BASIS | 510 | 510
  • SCM_BASIS | 700 | 700
  • SAP_APO 30A | SAPKY30A32 |
  • SAP_APO 310 | SAPKY31027 |
  • SCM 400 | SAPKY40022 |
  • SCM 500 | SAPKY50016 |
  • SCM 410 | SAPKY41020 |
  • SCM_BASIS 700 | SAPK-70003INSCMBASIS |
  • SCM_BASIS 510 | SAPK-51013INSCMBASIS |

Affected component

    SCM-APO-MD-LO
    Location

CVSS

Score: 0

Exploit

Detailed vulnerability information added to RedRays Security Platform. Contact [email protected] for details.

URL

https://launchpad.support.sap.com/#/notes/1294675

TAGS

#/SAPAPO/MD_CHECK_AUTHORITY-C_APO_VERS

More to explorer

SAP Cloud Connector Certificate Validation Issue

Date of Release: February 13, 2024 Advisory ID: CVE-2024-25642 Affected Software: SAP Cloud Connector Versions Affected: 2.15.0 to 2.16.1 Vulnerability Summary:A critical vulnerability,

Protect Your SAP with RedRays Security Platform

Explore the Power of Our Scanner with an Interactive Prototype Below