PT-2018-15600 · Sap · Sap Fiori Client

Published 2018-11-13 · Updated 2019-02-01 · CVE-2018-2491

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP Fiori Client versions prior to 1.11.5

Description The issue allows malicious JavaScript code embedded in a deep link URL to run inside the application's built-in log viewer when the log level is set to "Debug" and the user opens the viewer and taps on the hyperlink.

Recommendations For versions prior to 1.11.5, update to version 1.11.5 to resolve the issue. As a temporary workaround, consider avoiding the use of the "Debug" log level and refrain from tapping on hyperlinks in the log viewer until the update is applied.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2018-2491

Affected Products

Sap Fiori Client

References · 4

• https://osv.dev/vulnerability/CVE-2018-2491 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-2491 · Security Note
• https://launchpad.support.sap.com/#/notes/2691126 · Vendor Advisory
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=503809832 · Vendor Advisory