PT-2018-2620 · Sap · Sap Fiori Client

Published 2018-09-11 · Updated 2019-10-03 · CVE-2018-2490

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP Fiori Client versions prior to 1.11.5

Description The issue is related to insufficient access control in the SAP Fiori Client mobile environment, which may allow a remote attacker to disclose protected information. The broadcast messages received by SAP Fiori Client are not protected by permissions.

Recommendations For SAP Fiori Client versions prior to 1.11.5, update to version 1.11.5 to address the issue.

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

CWE-264

Related Identifiers

BDU:2019-01230

CVE-2018-2490

Affected Products

Sap Fiori Client

References · 6

• https://launchpad.support.sap.com/#/notes/2691126 · Vendor Advisory
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=503809832 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-2490 · Security Note
• https://osv.dev/vulnerability/CVE-2018-2490 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-01230 · Security Note
• https://threatpost.ru/sap-published-monthly-security-updates/29196 · Note