Missing authorization check in CO-PC-PCP, SAP security note 1777228

SAP security note 1777228, "Missing authorization check in CO-PC-PCP", is a program error note released on February 12, 2013. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

An authenticated user can utilize functions within CO-PC-PCP that should have restricted access. This vulnerability may lead to an escalation of privileges, potentially allowing unauthorized actions within the system.

Solution

To address this vulnerability, install the provided Security Patch. This patch introduces the necessary authorization checks to prevent unauthorized access to restricted functions within CO-PC-PCP.

CVSS

Score 6.0 Vector: AV:N/AC:M/AU:S/C:P/I:P/A:P

References

• Automatic checks for security notes using RSECNOTE (outdated)

Affected components

• SAP_APPL 45A to 45B
• SAP_APPL 46A to 46C
• SAP_APPL 470
• SAP_APPL 500
• SAP_APPL 600 to 606
• SAP_APPL 616