Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
Производитель ПО
Наименование ПО
SAP Notes
(1235367-7)
SAP Support Packages
(SAPKY41019, SAPKY50014, SAPKY50015, SAPKY51008, SAPKY70001)
Описание
It might be useful to limit user rights for deletion of CVCs.
Как исправить
A new authorization object C_APO_CVC is created with fields ACTVT and APO_PSTRU. The following activities can be set: create CVCs, display CVCs, delete CVCs.
This authorization object is added to the objects checked by function module /SAPAPO/MCP_PERMISSION_CHECK2.
The behaviour of characteristic combination maintenance won't change if the new object C_APO_CVC is not assigned to any user, since the original object C_APO_FUN with function S_CHARC/C_CHARC is still checked. In addition the new object C_APO_CVC is also checked.
Note 1262016 has been created to check C_APO_CVC at other points where user might be able to maintain CVCs.
If the system doesn't allow to create the new authorization object (SAP namespace), you can import the attached files (102842.zip contains K102842.A3P and R102842.A3P) that contain the authorization object. The procedure is described in note 13719.
Manual activities:
Start transaction SU21, select object class 'APO', from context menu select 'Create Authorization Object'.
Enter
Object = C_APO_CVC
Text = APO Authorization Object: CVC Maintenance
Choose fields
ACTVT Activity
APO_PSTRU Planning Object Structure ID
Maintain 'Permitted Activities', marking the following entries:
01 Create or generate
03 Display
06 Delete
Maintain 'Authorization Object Documentation':
Definition
'You can use the authorization object C_APO_CVC to specify whether a user can maintain characteristic value combinations of a planning object structure in Demand Planning.
The rights that you assign here refer to all CVCs of a planning object structure, and not to individual CVCs.'
Defined fields
'The ACTVT field is available for maintaining the authorization object C_APO_CVC. You can choose the following activities for the ACTVT field:
01 (Create): Create CVCs
03 (Display): Display CVCs
06 (Delete): Delete CVCs
The APO_PSTRU field defines the planning object structure for which the user is allowed to execute the activities maintained in ACTVT.'
This authorization object is added to the objects checked by function module /SAPAPO/MCP_PERMISSION_CHECK2.
The behaviour of characteristic combination maintenance won't change if the new object C_APO_CVC is not assigned to any user, since the original object C_APO_FUN with function S_CHARC/C_CHARC is still checked. In addition the new object C_APO_CVC is also checked.
Note 1262016 has been created to check C_APO_CVC at other points where user might be able to maintain CVCs.
If the system doesn't allow to create the new authorization object (SAP namespace), you can import the attached files (102842.zip contains K102842.A3P and R102842.A3P) that contain the authorization object. The procedure is described in note 13719.
Manual activities:
Start transaction SU21, select object class 'APO', from context menu select 'Create Authorization Object'.
Enter
Object = C_APO_CVC
Text = APO Authorization Object: CVC Maintenance
Choose fields
ACTVT Activity
APO_PSTRU Planning Object Structure ID
Maintain 'Permitted Activities', marking the following entries:
01 Create or generate
03 Display
06 Delete
Maintain 'Authorization Object Documentation':
Definition
'You can use the authorization object C_APO_CVC to specify whether a user can maintain characteristic value combinations of a planning object structure in Demand Planning.
The rights that you assign here refer to all CVCs of a planning object structure, and not to individual CVCs.'
Defined fields
'The ACTVT field is available for maintaining the authorization object C_APO_CVC. You can choose the following activities for the ACTVT field:
01 (Create): Create CVCs
03 (Display): Display CVCs
06 (Delete): Delete CVCs
The APO_PSTRU field defines the planning object structure for which the user is allowed to execute the activities maintained in ACTVT.'
Ссылки
