Missing authorization check for SPP alert deletion, SAP security note 1491435

SAP security note 1491435, “Missing authorization check for SPP alert deletion”, is a note. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

A malicious user can exploit the deletion of alerts in the SPP application by using specially crafted inputs to execute arbitrary database commands. This can be used to retrieve or remove data persisted by the system.

Solution

To address this vulnerability, implement this security correction by applying SAP Note 1491435 or installing the corresponding support package.

Reason and prerequisites

This issue is caused by an SQL injection vulnerability. The code constructs an SQL statement including strings that can be altered by a malicious user. The manipulated SQL statement can retrieve additional information from the database or modify it.

References

• SAP Note 1491435 – Missing authorization check for SPP alert deletion
• SAP Note 1490783 – No authorization check when searching for alert types

Affected components

• Supply Chain Management > Advanced Planning and Optimization > Service Parts Planning > Shortage Analysis (SCM-APO-SPP-SHA)
• SCM: Versions 500, 510, 700, 701
• SCM_BASIS: Versions 500, 510, 700, 701