Missing Authorization Check in AP-PPE-SCM, SAP security note 1513952

SAP security note 1513952, “Missing Authorization Check in AP-PPE-SCM”, is a program error note released on 09.11.2010. Below are the symptom and the SAP recommended solution.

Description

Symptom

An authenticated user can use functionality of AP-PPE-SCM to which access should be restricted. This can potentially result in an escalation of privileges.

Solution

Please implement the attached correction.

Reason and prerequisites

AP-PPE-SCM lacks permission checks for an authenticated user’s authorization to access some of its functionality. This may result in undesired system behavior.

References

• 1425215 – Security Note Missing Authority Check for Call Transaction
• 888889 – Automatic checks for security notes using RSECNOTE (outdated)