CVE-2025-31328

published 2025-04-22

CVE-2025-31328: SAP Learning Solution is vulnerable to Cross-Site Request Forgery (CSRF), allowing an attacker to trick authenticated user into sending unintended requests to…

medium 4.6 CVSS 3.1

AV N AC L PR L UI R S U C L I L A N

SAP Learning Solution is vulnerable to Cross-Site Request Forgery (CSRF), allowing an attacker to trick authenticated user into sending unintended requests to the server. GET-based OData function is named in a way that it violates the expected behaviour. This issue could impact both the confidentiality and integrity of the application without affecting the availability.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
sap_se	sap_s_4_hana	—	—
sap_se	sap_s_4_hana	—	—

CWE-352