Skip links
RedRays - Your SAP Security Solution
Picture of Vahagn Vardanian

Vahagn Vardanian

Co-founder and CTO of RedRays

SAP Security on Udemy

Missing Authorization Check in SCM-BAS-MD-PR, SAP security note 1505613

SAP Note 1505613
SAP Security Note
Medium priority

SAP security note 1505613, “Missing Authorization Check in SCM-BAS-MD-PR”, is a program error note released on 14.12.2010. Below are the symptom, reason and prerequisites, SAP recommended solution and the affected software components.

ComponentSupply Chain Management > SCM Basis > Master Data > Product (SCM-BAS-MD-PR)
CategoryProgram error
PriorityCorrection with medium priority
TypeSAP Security Note
Version2
StatusReleased for Customer
Released on14.12.2010
LanguageEnglish

Description

Symptom

An authenticated user can use functionality of SCM-BAS-MD-PR to which access should be restricted. This can potentially result in an escalation of privileges.

Solution

Implement the attached correction instructions or install the corresponding support package.

Reason and prerequisites

SCM-BAS-MD-PR lacks permission checks for an authenticated user’s authorization to access some of its functionality. This may result in undesired system behavior.

Affected components

  • SCM (400 to 400)
  • SCM (410 to 410)
  • SCM (500 to 500)
  • SCM_BASIS (510 to 510)
  • SCM_BASIS (700 to 700)
  • SCM_BASIS (701 to 701)

Full note on SAP: SAP Support Launchpad note 1505613

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#Authorization #authorization check #SCM-BAS-MD-PR

Explore More