Description
SAP NetWeaver Enterprise Portal does not sufficiently protect certain server-side actions against cross-site request forgery. An unauthenticated attacker could craft a malicious link that, when clicked by an authenticated user, triggers an unintended action on the server. Successful exploitation could allow the attacker to modify non-sensitive information, resulting in a low impact on integrity. There is no impact on confidentiality and availability.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| SAP_SE | SAP NetWeaver Enterprise Portal | EP-BASIS 7.50, EP-BASIS-API 7.50, EP-RUNTIME 7.50, EP-ADMIN 7.50 | — |
Advisories 2
- NCSC-2026-0485 Kwetsbaarheden verholpen in SAP-producten NCSC-NL (Netherlands) · Nov 12, 2026
- WID-SEC-2026-4420 SAP Patch Day November 2026: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 9, 2026