Missing Authorization Check in SCM-BAS-MD-PR, SAP security note 1505613

SAP Note 1505613
SAP Security Note
Medium priority

SAP security note 1505613, “Missing Authorization Check in SCM-BAS-MD-PR”, is a program error note released on 14.12.2010. Below are the symptom, reason and prerequisites, SAP recommended solution and the affected software components.

ComponentSupply Chain Management > SCM Basis > Master Data > Product (SCM-BAS-MD-PR)

CategoryProgram error

PriorityCorrection with medium priority

TypeSAP Security Note

Version2

StatusReleased for Customer

Released on14.12.2010

LanguageEnglish

Description

Symptom

An authenticated user can use functionality of SCM-BAS-MD-PR to which access should be restricted. This can potentially result in an escalation of privileges.

Solution

Implement the attached correction instructions or install the corresponding support package.

Reason and prerequisites

SCM-BAS-MD-PR lacks permission checks for an authenticated user’s authorization to access some of its functionality. This may result in undesired system behavior.

Affected components

SCM (400 to 400)
SCM (410 to 410)
SCM (500 to 500)
SCM_BASIS (510 to 510)
SCM_BASIS (700 to 700)
SCM_BASIS (701 to 701)

Full note on SAP: SAP Support Launchpad note 1505613

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#Authorization #authorization check #SCM-BAS-MD-PR