SAP security note 2665387, "Cross-Site Request Forgery (CSRF) Vulnerability in Cash Management", is a note. Below are the symptom and SAP recommended solution.
Description
Symptom
Manage banks allows an attacker to trick an authenticated user into sending unintended requests to the web server. This vulnerability is due to insufficient CSRF protection.
Modifying or state-changing function imports with HTTP Method "GET" leads to CSRF vulnerabilities.
Some well-known impacts of CSRF vulnerability are:
- Attacker could take actions on behalf of an authenticated user
- Loss of non-repudiation
Solution
Follow the manual steps and apply the correction instructions in this note or upgrade to the corresponding support package.
Reason and prerequisites
Program error.
CVSS
Score 5.5 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
Full note on SAP: SAP Support Launchpad note 2665387
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].