Skip links

MDSD Admin Console is vulnerable to XSRF attacks., SAP security note 1582983

Description

An un-authorized user can trigger functionality in MDSD Admin Console on behalf of an unsuspecting authorized user by fooling the unsuspecting user to trigger a URL callback via a script or special HTML element parameter.

Available fix and Supported packages

  • MBA-DSD | 2.1 | 2.1
  • MBA-DSD | 3.0 | 3.0
  • MBA-DSD | 4.0 | 4.0
  • MDSDADMINCONSOLE | 4.0 | 4.0
  • MDSD 3.0 | SP003 | 000000
  • MDSD 4.0 | SP001 | 000000
  • XMDSD 2.1 | SP001 | 000023
  • XMDSD 2.1 | SP002 | 000011
  • XMDSD 2.1 | SP003 | 000000

Affected component

    XX-INT-APP-SEC-SCP
    Security questions & issues in applications (Cloud Platform)

CVSS

Score: 0

Exploit

Exploit is not available.
For detailed information please contact the mail [email protected]

URL

https://launchpad.support.sap.com/#/notes/1582983

TAGS

#Cross-Site-Request-Forgery
#CSRF
#XSRF
#MDSD-Admin-Console