SAP security note 2316942, "Missing Authorization check in EWM for delivery / warehouse request objects". Below are the symptom, SAP recommended solution and reason and prerequisites.
Description
Symptom
A user can change delivery/warehouse request objects even if they have no change authorization.
Solution
Implement the correction instruction.
As after the correction, more strict authorization checks are in place. This may result in users encountering authorization check errors if they do not have the appropriate authorizations.
This correction has a known side effect: SAP Note 2704459 – Delivery authorization check for activity 23 (Maintain) prevents end user to finish the process.
Reason and prerequisites
The user must at least have display authorization (ACTVT=03). If they do not have this authorization, the above symptom will also not occur.
Full note on SAP: SAP Support Launchpad note 2316942
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].