Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
Производитель ПО
Наименование ПО
SAP Notes
(1469845-3)
SAP Support Packages
(SAPK-60307INEARETAIL, SAPK-60407INEARETAIL, SAPK-60502INEARETAIL)
Описание
This note is relevant only if the business function ISR_RETAIL_RMA has been activated.
In the RMA, authorization checks that regulate access to functions are missing. A user that is logged on can simply call these functions without these checks and this may result in an unwanted change to the system behavior.
In the RMA, authorization checks that regulate access to functions are missing. A user that is logged on can simply call these functions without these checks and this may result in an unwanted change to the system behavior.
Как исправить
The new role SAP_ISR_RMA_ADMINISTRATOR is delivered with ECC 6.05 Support Package (SP) 02, ECC 6.04 SP07 and ECC 6.03 SP07. Correction instructions for the authorization checks are attached for ECC 6.05 and 6.04. Note the following manual tasks.
------------------------------------------------------------------------
|Manual Post-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component EA-RETAIL SAP R/3 Enterpr...|
| Release 605 Until SAPK-60501INEARETAIL |
------------------------------------------------------------------------
Create transaction S_E5R_84000137 as a parameter transaction as follows:
- Package: WRF_ORGPRICE_DDIC
- Transaction text: Data Transfer Table WRF_ORGPRICE
- Transaction: START_REPORT
- Skip initial screen
- Inherit GUI attributes
- Professional User Transaction
- GUI support: SAP GUI for HTML, SAP GUI for Java, SAP GUI for Windows
- Default Values:
D_SREPOVARI-REPORTTYPE
D_SREPOVARI-REPORT RWRF_ORGPRICE_SETUP
Create the role SAP_ISR_RMA_ADMINISTRATOR as follows:
Description: RMA administrator
Menu:
- Transaction WRMA_CHECK
- Folder for RMA inbound with transactions:
WRMA_WRART
WRMA_NO_DOC
WRMA_VALUES
WRMA_DATA_DISPLAY
- Folder for original price with transactions:
S_E5R_84000137
WRF_ORGPR_MAINTAIN
------------------------------------------------------------------------
|Manual Post-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component EA-RETAIL SAP R/3 Enterpr...|
| Release 604 Until SAPK-60406INEARETAIL |
------------------------------------------------------------------------
Create transaction S_E5R_84000137 as a parameter transaction as follows:
- Package: WRF_ORGPRICE_DDIC
- Transaction text: Data Transfer Table WRF_ORGPRICE
- Transaction: START_REPORT
- Skip initial screen
- Inherit GUI attributes
- Professional User Transaction
- GUI support: SAP GUI for HTML, SAP GUI for Java, SAP GUI for Windows
- Default Values:
D_SREPOVARI-REPORTTYPE
D_SREPOVARI-REPORT RWRF_ORGPRICE_SETUP
Create the role SAP_ISR_RMA_ADMINISTRATOR as follows:
Description: RMA administrator
Menu:
- Transaction WRMA_CHECK
- Folder for RMA inbound with transactions:
WRMA_WRART
WRMA_NO_DOC
WRMA_VALUES
WRMA_DATA_DISPLAY
- Folder for original price with transactions:
S_E5R_84000137
WRF_ORGPR_MAINTAIN
------------------------------------------------------------------------
|Manual Post-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component EA-RETAIL SAP R/3 Enterpr...|
| Release 605 Until SAPK-60501INEARETAIL |
------------------------------------------------------------------------
Create transaction S_E5R_84000137 as a parameter transaction as follows:
- Package: WRF_ORGPRICE_DDIC
- Transaction text: Data Transfer Table WRF_ORGPRICE
- Transaction: START_REPORT
- Skip initial screen
- Inherit GUI attributes
- Professional User Transaction
- GUI support: SAP GUI for HTML, SAP GUI for Java, SAP GUI for Windows
- Default Values:
D_SREPOVARI-REPORTTYPE
D_SREPOVARI-REPORT RWRF_ORGPRICE_SETUP
Create the role SAP_ISR_RMA_ADMINISTRATOR as follows:
Description: RMA administrator
Menu:
- Transaction WRMA_CHECK
- Folder for RMA inbound with transactions:
WRMA_WRART
WRMA_NO_DOC
WRMA_VALUES
WRMA_DATA_DISPLAY
- Folder for original price with transactions:
S_E5R_84000137
WRF_ORGPR_MAINTAIN
------------------------------------------------------------------------
|Manual Post-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component EA-RETAIL SAP R/3 Enterpr...|
| Release 604 Until SAPK-60406INEARETAIL |
------------------------------------------------------------------------
Create transaction S_E5R_84000137 as a parameter transaction as follows:
- Package: WRF_ORGPRICE_DDIC
- Transaction text: Data Transfer Table WRF_ORGPRICE
- Transaction: START_REPORT
- Skip initial screen
- Inherit GUI attributes
- Professional User Transaction
- GUI support: SAP GUI for HTML, SAP GUI for Java, SAP GUI for Windows
- Default Values:
D_SREPOVARI-REPORTTYPE
D_SREPOVARI-REPORT RWRF_ORGPRICE_SETUP
Create the role SAP_ISR_RMA_ADMINISTRATOR as follows:
Description: RMA administrator
Menu:
- Transaction WRMA_CHECK
- Folder for RMA inbound with transactions:
WRMA_WRART
WRMA_NO_DOC
WRMA_VALUES
WRMA_DATA_DISPLAY
- Folder for original price with transactions:
S_E5R_84000137
WRF_ORGPR_MAINTAIN
Ссылки
