Cross-Site Request Forgery (CSRF) vulnerability in SAP S/4 HANA for Advanced Compliance Reporting/ Define Advanced Compliance Report, SAP security note 2711074

SAP security note 2711074, "Cross-Site Request Forgery (CSRF) vulnerability in SAP S/4 HANA for Advanced Compliance Reporting/ Define Advanced Compliance Report", is a note released on 12.02.2019. Below are the symptom and SAP recommended solution.

Description

Symptom

SAP S/4 HANA for Advanced Compliance Reporting allows an attacker to trick an authenticated user into sending unintended requests to the web server due to insufficient CSRF protection.

Impacts:

• Actions performed on behalf of an authenticated user
• Loss of non-repudiation

Solution

• Changed HTTP methods from GET to POST for vulnerable function imports.
• Utilized the XSRF protection framework to ensure correct authentication tokens are present.

CVSS

Score 6.3 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L