Skip links
RedRays - Your SAP Security Solution
Picture of Vahagn Vardanian

Vahagn Vardanian

Co-founder and CTO of RedRays

SAP Security on Udemy

Cross-Site Request Forgery (CSRF) vulnerability in Visual Composer 04s iviews., SAP security note 2360489

SAP Note 2360489
Medium priority

SAP security note 2360489, “Cross-Site Request Forgery (CSRF) Vulnerability in Visual Composer 04s iviews”, released on February 14, 2017. Below are the symptom and SAP recommended solution.

PriorityCorrection with medium priority
StatusReleased for Customer
Released onFebruary 14, 2017

Description

Symptom

Visual Composer 04s allows an attacker to trick an authenticated user into sending unintended requests to the web server. This vulnerability is due to insufficient CSRF protection.

  • Action on Behalf of User: An attacker could perform actions on behalf of an authenticated user.
  • Loss of Non-Repudiation: Users may be unable to prove the authenticity of their actions.

Solution

A CSRF token has been added to the request to mitigate this vulnerability. To protect your systems, please install the provided patch.

CVSS

Score 6.3 Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

References

Full note on SAP: SAP Support Launchpad note 2360489

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#CSRF #Visual Composer #Cross-Site Request Forgery #iviews

Explore More