PT-2017-3777 · Sap · Sap Fiori Client

Published 2017-12-15 · Updated 2019-10-03 · CVE-2018-2485

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions SAP Fiori Client versions prior to 1.11.5

Description The issue is related to insufficient access control in the SAP Fiori Client mobile environment, allowing a remote attacker to gain unauthorized access to protected information and execute arbitrary JavaScript code. This can include reading and writing of information and calling device-specific JavaScript APIs in the application.

Recommendations For versions prior to 1.11.5, update to SAP Fiori Client version 1.11.5 to address the issue.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2019-01224

CVE-2018-2485

Affected Products

Sap Fiori Client

References · 8

• https://launchpad.support.sap.com/#/notes/2691126 · Vendor Advisory
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=503809832 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-2485 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-2485 · Security Note
• https://bdu.fstec.ru/vul/2019-01224 · Security Note
• http://securityfocus.com/bid/105911 · Note
• https://securityfocus.com/bid/105911/discuss · Note
• https://threatpost.ru/sap-published-monthly-security-updates/29196 · Note