SAP security note 1430941, "Missing Authorization Check in RSP Transaction", is released on July 12, 2010. Below are the symptom and SAP recommended solution.
Description
Symptom
Missing authorization checks in the RSP transaction can allow an unauthorized user to execute the report /SAPAPO/RSP_PLAN_LOG_DELETE, enabling them to delete planning and scheduling logs for resources. Unauthorized deletion of logs can compromise data integrity and disrupt planning operations.
Solution
Implement SAP Note 1430941 to add the necessary authorization checks. Ensure all prerequisites are met before applying the note.
Full note on SAP: SAP Support Launchpad note 1430941
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].