Vulnerability · Published Apr 22, 2025 · Assigned by sap

CVE-2025-31328Cross-Site Request Forgery (CSRF) vulnerability in SAP S/4 HANA (Learning Solution)

Medium 4.6

In plain English

A medium-severity cross-site request forgery in SAP S/4 HANA (Learning Solution) from SAP_SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities).

Severity (CVSS 3.1)4.6Medium

Exploit odds (30 days)0.1%top 96.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

SAP Learning Solution is vulnerable to Cross-Site Request Forgery (CSRF), allowing an attacker to trick authenticated user into sending unintended requests to the server. GET-based OData function is named in a way that it violates the expected behaviour. This issue could impact both the confidentiality and integrity of the application without affecting the availability.

Affected products (as reported)

Vendor	Product	Versions
SAP_SE	SAP S/4 HANA (Learning Solution)	S4HCMGXX 100101

Weakness: CWE-352 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

In plain English

Official description

Affected products (as reported)

References