CVE-2025-31328

SAP Learning Solution is vulnerable to Cross-Site Request Forgery (CSRF), allowing an attacker to trick authenticated user into sending unintended requests to the server. GET-based OData function is named in a way that it violates the expected behaviour. This issue could impact both the confidentiality and integrity of the application without affecting the availability.

• CWE-352

• https://me.sap.com/notes/3446649
• https://url.sap/sapsecuritypatchday

Published

Apr 22, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-3130Improper Neutralization of Input During Web Page Generation …5.4
• CVE-2025-3131Cross-Site Request Forgery (CSRF) vulnerability in Drupal EC…5.4
• CVE-2025-31324SAP NetWeaver Visual Composer Metadata Uploader is not prote…9.8
• CVE-2025-31325Due to a Cross-Site Scripting vulnerability in SAP NetWeaver…5.8
• CVE-2025-31326SAP�BusinessObjects Business�Intelligence Platform (Web Inte…4.1
• CVE-2025-31327SAP Field Logistics Manage Logistics application OData meta-…4.3
• CVE-2025-31329SAP NetWeaver is vulnerable to an Information Disclosure vul…6.2
• CVE-2025-31330SAP Landscape Transformation (SLT) allows an attacker with u…9.9
• CVE-2025-31331SAP NetWeaver allows an attacker to bypass authorization che…4.3
• CVE-2025-31332Due to insecure file permissions in SAP BusinessObjects Busi…7.1
• CVE-2025-31333SAP S4CORE OData meta-data property is vulnerable to data ta…4.3
• CVE-2025-31334Issue that bypasses the "Mark of the Web" security warning f…6.8