Missing authorization check in SCM PDS Integration, SAP security note 1429094

SAP Note 1429094SAP Security NoteHigh priority

SAP security note 1429094, "Missing authorization check in SCM PDS Integration", is a note released on December 11, 2012. Below are the symptom and SAP recommended solution.

ComponentSupply Chain Management > Advanced Planning and Optimization > Interfaces > Master Data > Production Data Structure

PriorityCorrection with high priority

TypeSAP Security Note

Version4

StatusReleased for Customer

Released onDecember 11, 2012

Description

Symptom

An authenticated user can access functions of SCM PDS Integration that should be restricted. This may result in an escalation of privileges.

Solution

Implement the correction instructions provided in the SAP Note or import the relevant support package to address the missing authorization checks.

Reason and prerequisites

SCM PDS Integration lacks authorization checks for certain functions, leading to potential unauthorized access and undesired system behavior.

References

SAP Note 888889 – Automatic checks for security notes using RSECNOTE (outdated)

Full note on SAP: SAP Support Launchpad note 1429094

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#Production Data Structure #PDS Integration #SCM APO #Authorization Check