{"id":"CVE-2025-31328","aliases":["EUVD-2025-12262","GHSA-q7h8-385m-x32m"],"status":"published","title":"Cross-Site Request Forgery (CSRF) vulnerability in SAP S/4 HANA (Learning Solution)","description":"SAP Learning Solution is vulnerable to Cross-Site Request Forgery (CSRF), allowing an attacker to trick authenticated user into sending unintended requests to the server. GET-based OData function is named in a way that it violates the expected behaviour. This issue could impact both the confidentiality and integrity of the application without affecting the availability.","severity":{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00144,"percentile":0.03708,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-352"],"published":"2025-04-22T18:25:55Z","modified":"2026-06-17T09:10:14Z","products":[{"vendor":"sap_se","product":"sap s/4 hana (learning solution)"}],"references":[{"url":"https://me.sap.com/notes/3446649"},{"url":"https://url.sap/sapsecuritypatchday"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-31328"},{"url":"https://github.com/advisories/GHSA-q7h8-385m-x32m"}],"sources":{"cve":[{"id":"CVE-2025-31328","title":"Cross-Site Request Forgery (CSRF) vulnerability in SAP S/4 HANA (Learning Solution)","description":"SAP Learning Solution is vulnerable to Cross-Site Request Forgery (CSRF), allowing an attacker to trick authenticated user into sending unintended requests to the server. GET-based OData function is named in a way that it violates the expected behaviour. This issue could impact both the confidentiality and integrity of the application without affecting the availability.","status":"published","published":"2025-04-22T18:25:55.117Z","modified":"2025-04-23T15:58:47.132Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:32:44.424933Z"}],"euvd":[{"id":"EUVD-2025-12262","description":"SAP Learning Solution is vulnerable to Cross-Site Request Forgery (CSRF), allowing an attacker to trick authenticated user into sending unintended requests to the server. GET-based OData function is named in a way that it violates the expected behaviour. This issue could impact both the confidentiality and integrity of the application without affecting the availability.","status":"published","published":"2025-04-22T18:25:55Z","modified":"2025-04-23T15:58:47Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:52:13.655516Z"}],"ghsa":[{"id":"GHSA-q7h8-385m-x32m","title":"SAP Learning Solution is vulnerable to Cross-Site Request Forgery (CSRF), allowing an attacker to...","description":"SAP Learning Solution is vulnerable to Cross-Site Request Forgery (CSRF), allowing an attacker to trick authenticated user into sending unintended requests to the server. GET-based OData function is named in a way that it violates the expected behaviour. This issue could impact both the confidentiality and integrity of the application without affecting the availability.","status":"published","published":"2025-04-22T21:30:44Z","modified":"2025-04-22T21:30:50Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T15:01:59.626328Z"}],"nvd":[{"id":"CVE-2025-31328","description":"SAP Learning Solution is vulnerable to Cross-Site Request Forgery (CSRF), allowing an attacker to trick authenticated user into sending unintended requests to the server. GET-based OData function is named in a way that it violates the expected behaviour. This issue could impact both the confidentiality and integrity of the application without affecting the availability.","status":"published","published":"2025-04-22T19:15:52.57Z","modified":"2026-06-17T09:10:14.743Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:11:01.507281Z"}]}}