PT-2018-15590 · Sap · Sap Fiori

Publicado 2018-10-09 · Atualizado 2019-01-04 · CVE-2018-2474

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions SAP Fiori 1.0 for SAP ERP HCM (Approve Leave Request, version 2)

Description The issue is due to insufficient CSRF protection, allowing an attacker to trick an authenticated user into sending an unintended request to the web server.

Recommendations For SAP Fiori 1.0 for SAP ERP HCM (Approve Leave Request, version 2), consider implementing proper CSRF protection mechanisms to prevent unintended requests. As a temporary workaround, restrict access to sensitive functionalities within the application to minimize the risk of exploitation.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2018-2474

Produtos afetados

Sap Fiori

Referências · 5

• https://osv.dev/vulnerability/CVE-2018-2474 · Aviso do Fabricante
• https://launchpad.support.sap.com/#/notes/2696889 · Nota
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=500633095 · Aviso do Fabricante
• http://securityfocus.com/bid/105534 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-2474 · Nota de Segurança