Skip links

Cross-Site Request Forgery (CSRF) vulnerability in SAP Fiori APP-Process Collection Worklist, SAP security note 2733219

Description

 SAP Fiori APP-Process Collection Worklist allows an attacker to trick an authenticated user to send unintended request to the web server. This vulnerability is due to insufficient CSRF protection.

Some well-known impacts of CSRF vulnerability are –

  • Attacker could take actions on behalf of an authenticated user
  • Loss of non-repudiation

Available fix and Supported packages

  • UIAPFI70 | 200 | 200
  • UIAPFI70 | 300 | 300
  • UIAPFI70 | 400 | 400
  • UIAPFI70 | 500 | 500
  • UIAPFI70 200 | SAPK-20008INUIAPFI70 |
  • UIAPFI70 300 | SAPK-30008INUIAPFI70 |
  • UIAPFI70 400 | SAPK-40006INUIAPFI70 |
  • UIAPFI70 500 | SAPK-50004INUIAPFI70 |

Affected component

    FIN-FIO-CCD
    Fiori-UI for SAP Collections Management, SAP Credit Managem.

CVSS

Score: 6.3
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Exploit

Exploit is not available.
For detailed information please contact the mail [email protected]

URL

https://launchpad.support.sap.com/#/notes/2733219

TAGS

#Open-redirect
#cross-site-redirect
#cross-domain-redirect
#XSRF
#session-riding