Missing Authorization check in SD-MD-CH, SAP security note 2316249

SAP security note 2316249, "Missing Authorization check in SD-MD-CH". Below are the symptom and SAP recommended solution.

Description

Symptom

SD-MD-CH does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.

Impacts of Missing Authorization Check:

• Abuse of functionality restricted to specific user groups
• Unauthorized read, modify, or delete of restricted data

Solution

Implement the recommended coding corrections as outlined in SAP Note 2316249.

Reason and prerequisites

SD-MD-CH lacks authorization checks to verify an authenticated user’s permissions for accessing certain functions, which may lead to undesired system behavior.