Missing authorization check in Process Management., SAP security note 1864397

SAP security note 1864397, "Missing authorization check in Process Management.", is a program error note released on September 7, 2013. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

An authenticated user can use functions of Process Management to which access should be restricted. This may result in an escalation of privileges.

Solution

Implement the attached correction instructions.

Reason and prerequisites

Process Management does not contain authorization checks for verifying an authenticated user’s authorization to access certain functions. This oversight may lead to undesired system behavior.

CVSS

Score 4.6 Vector: AV:N/AC:H/AU:S/C:P/I:P/A:P

Affected components

• Production Planning and Control > Production Planning for Process Industries > Process Management > Xsteps (Execution Steps) (PP-PI-PMA-XS)