SAP security note 1424979, "Security Check: Call transaction authorization checks", is a note. Below are the symptom and SAP recommended solution.
Description
Symptom
Users who do not have authorization to call specific transactions are able to do so, bypassing the necessary authorization checks.
Solution
Follow these manual steps to resolve the issue:
- Step 1: Open transaction SE91 and navigate to the message class /SAPAPO/MSPPPEMSP in change mode. Add new message: Message Number 002, Message Text "No Authorization to call transaction &1 ‘X’". Save your changes.
- Step 2: Open transaction SE91 again and navigate to the message class /SAPAPO/MSPAPO in change mode. Add new message: Message Number 055, Message Text "No Authorization to call transaction &1 ‘X’". Save your changes.
- Implementation: Apply the SAP Note or the corresponding support package to ensure all changes are correctly implemented.
Full note on SAP: SAP Support Launchpad note 1424979
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
