Missing authorization check in Dangerous Goods Management of EHS Services in SCM, SAP security note 2688383

SAP security note 2688383, "Missing authorization check in Dangerous Goods Management of EHS Services in SCM", is a program error note released on 13.07.2021. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

This SAP Note has been released again. The manual correction instructions for all releases have been adjusted: when you create the text element, you do not have to specify a length.

Dangerous Goods Management of EHS Services in SCM does not perform the necessary authorization checks for an authenticated user, which may result in an escalation of privileges.

• Abuse of functionality restricted to a particular user group.
• Unauthorized reading, modification, or deletion of restricted data.

Solution

For Dangerous Goods Management of EHS Services in SCM, the authorization object M_MATE_DGM ("DG Material Master: Master Data") is checked. After implementing the correction, additional authorization checks will be performed.

CVSS

Score 6.3 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Affected components

• SCM_BASIS: 700 to 714
• S4CORE: 101 to 103
• SAPSCORE: 115