PT-2018-15590 · Sap · Sap Fiori

Published 2018-10-09 · Updated 2019-01-04 · CVE-2018-2474

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions SAP Fiori 1.0 for SAP ERP HCM (Approve Leave Request, version 2)

Description The issue is due to insufficient CSRF protection, allowing an attacker to trick an authenticated user into sending an unintended request to the web server.

Recommendations For SAP Fiori 1.0 for SAP ERP HCM (Approve Leave Request, version 2), consider implementing proper CSRF protection mechanisms to prevent unintended requests. As a temporary workaround, restrict access to sensitive functionalities within the application to minimize the risk of exploitation.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2018-2474

Affected Products

Sap Fiori

References · 5

• https://osv.dev/vulnerability/CVE-2018-2474 · Vendor Advisory
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=500633095 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-2474 · Security Note
• https://launchpad.support.sap.com/#/notes/2696889 · Note
• http://securityfocus.com/bid/105534 · Note