SAP security note 2688018, "[CVE-2018-2474] Cross-Site Request Forgery (CSRF) vulnerability in SAP Approve Leave Request V2 application". Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
Approve Leave Request V2 application allows an attacker to trick an authenticated user to send unintended requests to the web server. This vulnerability is due to insufficient CSRF protection.
Attacker could take actions on behalf of an authenticated user.
Loss of non-repudiation.
Solution
The XSRF protection framework is now properly utilized, checking for correct authentication tokens to be present. Implement the Support Packages and Patches referenced by this SAP Note.
Reason and prerequisites
CSRF tokens were not used in the application.
CVSS
Score 4.3 / 10 Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Affected components
- GBX01HR (600 to 600)
Full note on SAP: SAP Support Launchpad note 2688018
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
