SAP MDM Server Session Hijacking Vulnerability Allowing Unauthorized Function Execution

A vulnerability in SAP MDM Server allows an attacker to hijack existing client sessions and execute certain functions without re-authenticating. This could lead to unauthorized access or modification of non-sensitive information, or the consumption of resources that degrade server performance.

Impact

Exploitation of this vulnerability could result in session hijacking, allowing attackers to execute functions on behalf of the user and potentially access or modify information or disrupt server performance.

Remediation

Users are advised to review and implement the SAP Security Notes available in SAP for Me. SAP Security Patch Day occurs on the second Tuesday of every month, when SAP publishes important security updates. For more information, consult the SAP Security Notes FAQ.