Skip links
Vahagn Vardanian

Vahagn Vardanian

Co-founder and CTO of RedRays

Missing authority check in Demand Planning transaction, SAP security note 1428998

Description

In general when starting a transaction, autorization checks are executed to verify that the user can access the transaction. Sometimes transactions are called during program execution. In that case, the program should execute the authorization check itself before calling the transaction.
In this note, authorization checks are added when programs are starting the transactions SE18 for BADI maintenance and /SAPAPO/MC96B for forecast profile maintenance.

Available fix and Supported packages

  • SCM | 410 | 410
  • SCM | 500 | 500
  • SCM | 510 | 510
  • SCM | 700 | 700
  • SCM 410 | SAPKY41020 |
  • SCM 500 | SAPKY50017 |
  • SCM 510 | SAPKY51013 |
  • SCM 700 | SAPKY70006 |

Affected component

    SCM-APO-FCS
    Demand Planning

CVSS

Score: 0

PoC

Detailed vulnerability information added to RedRays Security Platform. Contact [email protected] for details.

URL

https://launchpad.support.sap.com/#/notes/1428998

TAGS

#Security-Update

More to explorer

Special offer for SAP Security Udemy course!

$ 9.99

Join “SAP Security Core Concepts and Security Administration” which is part of the Blackhat course series.