CVE-2025-31328 - Cross-Site Request Forgery (CSRF) vulnerability in SAP S/4 HANA (Learning Solution) · CoreCVE

Back Back to CVE browser

MEDIUM

Cross-Site Request Forgery (CSRF) vulnerability in SAP S/4 HANA (Learning Solution)

Published Apr 22, 2025

4.6

MEDIUM

CVSS 3.1

EPSS 0.14%

Description

SAP Learning Solution is vulnerable to Cross-Site Request Forgery (CSRF), allowing an attacker to trick authenticated user into sending unintended requests to the server. GET-based OData function is named in a way that it violates the expected behaviour. This issue could impact both the confidentiality and integrity of the application without affecting the availability.

Affected products

Vendor SAP SE Product SAP S/4 HANA (Learning Solution) Default
unaffected
Affected
- 101
- S4HCMGXX 100

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
SAP SE	SAP S/4 HANA (Learning Solution)	unaffected	Affected 101 S4HCMGXX 100

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-352

CSRF

References (3)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-12262		Advisory
https://me.sap.com/notes/3446649
https://url.sap/sapsecuritypatchday

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner sap

Published Apr 22, 2025

Updated Apr 23, 2025

Reserved Mar 27, 2025

Link CVE-2025-31328

CISA Vulnrichment

Updated Apr 22, 2025

NVD

Status Deferred

Modified Jun 17, 2026

Link CVE-2025-31328

Red Hat

No data

ENISA EUVD

Assigner sap

Published Apr 22, 2025

Updated Apr 23, 2025

Link EUVD-2025-12262

GitHub

No data