Skip links
RedRays - Your SAP Security Solution
Picture of Vahagn Vardanian

Vahagn Vardanian

Co-founder and CTO of RedRays

SAP Security on Udemy

Missing Authorization check in SAP Direct Store Delivery, SAP security note 2580258

SAP Note 2580258
SAP Security Note
Medium priority

SAP security note 2580258, "Missing Authorization check in SAP Direct Store Delivery", is a program error note released on 20.12.2017. Below are the symptom and SAP recommended solution.

ComponentBusiness Mobile > Mobile Applications > SAP Direct Store Delivery for ERP > SAP Direct Store Delivery
CategoryProgram error
PriorityCorrection with medium priority
TypeSAP Security Note
Version1
StatusReleased for Customer
Released on20.12.2017
LanguageEnglish

Description

Symptom

SAP Direct Store Delivery does not perform necessary authorization checks. This might allow a user to access data that he/she might not be authorized to access.

Solution

The affected functions have now been enforced to properly check access restrictions.

Please implement the correction instructions.

Full note on SAP: SAP Support Launchpad note 2580258

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#Access control #Authorization error #Authorization profile

Explore More