Missing authorization check in IS-R-PUR-MPO, SAP security note 2031795

SAP Note 2031795
SAP Security Note
Medium priority

SAP security note 2031795, "Missing Authorization Check in IS-R-PUR-MPO", is a note released on 11.11.2014. Below are the symptom, SAP recommended solution and the affected software components.

ComponentIS-R-PUR-MPO (Industry-Specific Component Retail > Retail Purchasing > Mass Maintenance Purchase Orders)

PriorityCorrection with medium priority

TypeSAP Security Note

StatusReleased for Customer

Released on11.11.2014

LanguageEnglish

Description

Symptom

An authenticated user can utilize functions of the IS-R-PUR-MPO component that should have restricted access. This may lead to an escalation of privileges.

Solution

New authorization checks have been implemented to ensure proper access control within the IS-R-PUR-MPO component.

Reason and prerequisites

The IS-R-PUR-MPO component lacks necessary authorization checks to verify an authenticated user’s permissions for accessing certain functions, potentially causing undesired system behavior.

References

Referenced by

2317864 – MASS_EKKO: Authorization check issue with note 2031795

Affected components

SAP_APPL (versions 600 to 617)

Full note on SAP: SAP Support Launchpad note 2031795

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#Authorization #IS-R-PUR-MPO #Mass Maintenance Purchase Orders