Missing authorization check while navigating to ITS function, SAP security note 1522579

SAP Note 1522579
High priority

SAP security note 1522579, "Missing authorization check while navigating to ITS function", is a note released on 14.12.2010. Below are the symptom and SAP recommended solution.

ComponentSupply Chain Management > Supply Network Collaboration > Alert Monitor

PriorityCorrection with high priority

StatusReleased for Customer

Released on14.12.2010

Description

Symptom

An authenticated user can use functionality of alert in ITS to which access should be restricted. This can potentially result in an escalation of privileges.

Solution

Implement the attached source code correction as outlined in the manual correction instructions provided in the note.

Reason and prerequisites

Navigation to ITS functions lacks permission checks to authenticate a user’s authorization to access some of its functionalities. This may result in undesired system behavior.

Full note on SAP: SAP Support Launchpad note 1522579

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#Alert Monitor #Supply Network Collaboration #Supply Chain Management