Home

Description

SAP Learning Solution is vulnerable to Cross-Site Request Forgery (CSRF), allowing an attacker to trick authenticated user into sending unintended requests to the server. GET-based OData function is named in a way that it violates the expected behaviour. This issue could impact both the confidentiality and integrity of the application without affecting the availability.

PUBLISHED Reserved 2025-03-27 | Published 2025-04-22 | Updated 2025-04-23 | Assigner sap




MEDIUM: 4.6CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Problem types

CWE-352: Cross-Site Request Forgery (CSRF)

Product status

Default status
unaffected

S4HCMGXX 100
affected

101
affected

References

me.sap.com/notes/3446649

url.sap/sapsecuritypatchday

cve.org (CVE-2025-31328)

nvd.nist.gov (CVE-2025-31328)

Download JSON