SAP Note 1262016 - Missing authority check in APO transaction

Symptom
After implementing note 1235367, which introduced a new authorization object (C_APO_CVC) to control user rights for CVC maintenance by POS, some authorization check is still missing.
Information disclosure due to missing authorization checks in some APO transactions.


Other terms
C_APO_CVC


Reason and Prerequisites
Note 1235367 is implemented. Some authorization check is still missing in some APO transactions.


Solution
Please apply the attached correction or install the corresponding
support package.

Affected Releases

Software Component Release From Release To Release And subsequent SCM 410 410 410   SCM 500 500 500   SCM 510 510 510   SCM 700 700 700

Correction delivered in Support Package

Support Packages Release Package Name SCM 410 SAPKY41019 SCM 500 SAPKY50015 SCM 510 SAPKY51009 SCM 700 SAPKY70002

Corrections Instructions

Correction Instruction Valid from Valid to Software Component Last Modifcation 691897 700 700 SCM 17.10.2008  12:59:14 692067 510 510 SCM 17.10.2008  13:24:09 693738 500 500 SCM 21.10.2008  10:13:08 693739 410 410 SCM 21.10.2008  10:25:26

Direct Link : https://service.sap.com/sap/support/notes/1262016