Missing authorization check in SCM-APO-INT, SAP security note 1519666

SAP Note 1519666
SAP Security Note
Medium priority

SAP security note 1519666, "Missing authorization check in SCM-APO-INT", is a program error note released on 14.12.2010. Below are the symptom, SAP recommended solution and the affected software components.

ComponentSCM-APO-INT (Supply Chain Management > Advanced Planning and Optimization > Interfaces)

CategoryProgram error

PriorityCorrection with medium priority

TypeSAP Security Note

Version3

StatusReleased for Customer

Released on14.12.2010

Description

Symptom

Certain functions of SCM-APO-INT can be called, even if the user does not have the required authorization. This may result in an escalation of privileges.

Solution

Implement the correction instructions or import the relevant Support Package for your release.

Reason and prerequisites

In SCM-APO-INT, authorization checks that regulate access to functions are missing. A user who is logged on can simply call these functions without these checks, potentially leading to unwanted changes in the system behavior.

CVSS

Score 0

Affected components

SCM: 400, 410, 500, 510

Full note on SAP: SAP Support Launchpad note 1519666

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#SCM-APO-INT #Authorization Check #Privilege Escalation #SCM