Missing authorization check in CRM-MKT-MPL-ST-PRO, SAP security note 1765099

SAP security note 1765099, "Missing authorization check in CRM-MKT-MPL-ST-PRO". Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

An authenticated user can use functions of CRM-MKT-MPL-ST-PRO to which access should be restricted. This may result in an escalation of privileges.

Solution

Implement the correction as provided in the SAP Security Note.

Reason and prerequisites

CRM-MKT-MPL-ST-PRO does not contain authorization checks for verifying an authenticated user’s authorization to access certain functions. This may result in undesired system behavior.

CVSS

Score 4.9 Vector: AV:N/AC:M/AU:S/C:P/I:P/A:N

References

• 2307675 – Trade Promotion: Authorization checks are not working properly while adding product

Affected components

• CRM-MKT-MPL-ST-PRO (Customer Relationship Management > Marketing > Marketing Planner > Basic Functions > Product Assignment)
• Versions affected: 600, 700, 701, 702+, 712, 713