Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
Производитель ПО
Наименование ПО
SAP Notes
(1486833-1)
SAP Support Packages
(SAPKY50019, SAPKY51015, SAPKY70009, SAPKY70103)
Описание
Roles SAP_SCM_INTEGRATION and /SAPAPO/DP_SUPERUSER lacking permission checks for an authenticated user's authorization to access some of its functionality. This may result in undesired system behavior.
Как исправить
The role /SAPAPO/DP_SUPERUSER is obsolete and have to be replaced by the role SAP_SCM_FCS_PLN_ADM. Additionally this role shall be adapted manually.
Implement the support package or execute the following manual steps:
Role SAP_SCM_INTEGRATION
Goto transaction PFCG
Enter the role SAP_SCM_INTEGRATION and press the "Change" button
Goto tabstrip "Authorizations"
Press the button "Change Authorization Data"
Expand the entry "Cross-application Authorization Objects"
Select the entry "Transaction Code Check at Transaction Start" and press the remove button
Press the delete button (trash can symbol) and press OK on the dialog box
Return to the main screen of the transaction PFCG and enter the role SAP_SCM_INTEGRATION and press the transport button
The field "Also Transport generated profiles for Single Roles" should be active
Press the execute button
Press continue on the dialog box
On the dialog box "Choose objects" activate the field "Personalization" and press OK
Press continue on the dialog box
Role /SAPAPO/DP_SUPERUSER
Goto transaction PFCG
Enter the role /SAPAPO/DP_SUPERUSER and press the "Change" button
Goto tabstrip "Authorizations"
Press the button "Change Authorization Data"
Expand the entry "Cross-application Authorization Objects"
Mark the two entries you will find for object "Transaction Code Check at Transaction Start" having the value "All transactions" in the attribute "Transaction code" and press the deactivate button (minus symbol)
Press the delete button (trash can symbol) and press OK on the dialog box.
Return to the main screen of the transaction PFCG and enter the role /SAPAPO/DP_SUPERUSER and press the transport button
The field "Also Transport generated profiles for Single Roles" should be active
Press the execute button
Press continue on the dialog box
On the dialog box "Choose objects" activate the field "Personalization" and press OK
Select a transport and transport the role
Leave the transaction
Implement the support package or execute the following manual steps:
Role SAP_SCM_INTEGRATION
Goto transaction PFCG
Enter the role SAP_SCM_INTEGRATION and press the "Change" button
Goto tabstrip "Authorizations"
Press the button "Change Authorization Data"
Expand the entry "Cross-application Authorization Objects"
Select the entry "Transaction Code Check at Transaction Start" and press the remove button
Press the delete button (trash can symbol) and press OK on the dialog box
Return to the main screen of the transaction PFCG and enter the role SAP_SCM_INTEGRATION and press the transport button
The field "Also Transport generated profiles for Single Roles" should be active
Press the execute button
Press continue on the dialog box
On the dialog box "Choose objects" activate the field "Personalization" and press OK
Press continue on the dialog box
Role /SAPAPO/DP_SUPERUSER
Goto transaction PFCG
Enter the role /SAPAPO/DP_SUPERUSER and press the "Change" button
Goto tabstrip "Authorizations"
Press the button "Change Authorization Data"
Expand the entry "Cross-application Authorization Objects"
Mark the two entries you will find for object "Transaction Code Check at Transaction Start" having the value "All transactions" in the attribute "Transaction code" and press the deactivate button (minus symbol)
Press the delete button (trash can symbol) and press OK on the dialog box.
Return to the main screen of the transaction PFCG and enter the role /SAPAPO/DP_SUPERUSER and press the transport button
The field "Also Transport generated profiles for Single Roles" should be active
Press the execute button
Press continue on the dialog box
On the dialog box "Choose objects" activate the field "Personalization" and press OK
Select a transport and transport the role
Leave the transaction
Ссылки
