Skip links
Arpine Maghakyan

Arpine Maghakyan

Security Researcher of RedRays.

Missing authority check in Demand Planning transaction, SAP security note 1428998

Description

In general when starting a transaction, autorization checks are executed to verify that the user can access the transaction. Sometimes transactions are called during program execution. In that case, the program should execute the authorization check itself before calling the transaction.
In this note, authorization checks are added when programs are starting the transactions SE18 for BADI maintenance and /SAPAPO/MC96B for forecast profile maintenance.

Available fix and Supported packages

  • SCM | 410 | 410
  • SCM | 500 | 500
  • SCM | 510 | 510
  • SCM | 700 | 700
  • SCM 410 | SAPKY41020 |
  • SCM 500 | SAPKY50017 |
  • SCM 510 | SAPKY51013 |
  • SCM 700 | SAPKY70006 |

Affected component

    SCM-APO-FCS
    Demand Planning

CVSS

Score: 0

Exploit

Exploit is not available.
For detailed information please contact the mail [email protected].

URL

https://launchpad.support.sap.com/#/notes/1428998

TAGS

#Security-Update

More to explorer