Cross-Site Request Forgery in SAP CRM Java Component
CVE-2017-15296

8.8HIGH

Key Information:

Vendor

SAP
Status
Customer Relationship Management
Vendor
CVE Published:
16 October 2017

What is CVE-2017-15296?

The Java component in SAP CRM is susceptible to a Cross-Site Request Forgery (CSRF) attack, which can allow unauthorized actions to be performed on behalf of an authenticated user. This vulnerability highlights the importance of implementing proper security measures such as anti-CSRF tokens to protect sensitive transactions within the SAP environment. For detailed information, refer to SAP Security Note 2478964 and advisory from ERPScan.

References

https://erpscan.io/advisories/erpscan-17-036-csrf-sap-jav...
x_refsource_MISC
https://blogs.sap.com/2017/07/11/sap-security-patch-day-j...
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.