Forums application is vulnerable to CSRF attack, SAP security note 1641116

SAP security note 1641116, "Forums application is vulnerable to CSRF attack", is a program error note released on 14.02.2012. Below are the symptom and SAP recommended solution.

Description

Symptom

An attacker can execute functions in the forums application without authentication and authorization.

Solution

A.) For more information about the affected releases, refer to the "SP Patch Level" tab of this SAP note. For details on the SP Stack schedule and updates, visit SP Stacks maintenance schedule.

B.) Possible Workaround: There is no workaround available before the release of the mentioned deliveries.

Reason and prerequisites

The forums application executes certain functions by referencing specific URLs. When an attacker tricks an authenticated user’s browser into making a request containing a specific URL and parameters, the function is executed using the user’s rights. This can be achieved through a cross-site scripting attack or by presenting a malicious link to the victim.

• The patch from SAP Note 1450166 must be implemented in the system.

CVSS

Score 0

References