SAP Note 1425215
SAP security note 1425215, "Security Note Missing Authority Check for Call Transaction". Below are the symptom and SAP recommended solution.
Description
Symptom
Possible security issues have been found, from type "Missing Authority Check for Call Transaction". This ABAP Statement does not check for the authorization to start the transaction. So an unauthorized user is also allowed to use the transaction.
Unauthorized users can access and use the transaction without proper authorization checks.
Solution
Please implement the correction as outlined in the security note.
References
- 1513952 – Missing Authorization Check in AP-PPE-SCM
- 888889 – Automatic checks for security notes using RSECNOTE (outdated)
Full note on SAP: SAP Support Launchpad note 1425215
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].