Vulnerability Description
When opening a deep link URL in SAP Fiori Client with log level set to "Debug", the client application logs the URL to the log file. If this URL contains malicious JavaScript code it can eventually run inside the built-in log viewer of the application in case user opens the viewer and taps on the hyperlink in the viewer. SAP Fiori Client version 1.11.5 in Google Play store addresses these issues and users must update to that version.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Sap | Fiori Client | < 1.11.5 |
Related Weaknesses (CWE)
References
- https://launchpad.support.sap.com/#/notes/2691126Permissions RequiredVendor Advisory
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=503809832Vendor Advisory
- https://launchpad.support.sap.com/#/notes/2691126Permissions RequiredVendor Advisory
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=503809832Vendor Advisory
FAQ
What is CVE-2018-2491?
CVE-2018-2491 is a vulnerability with a CVSS score of 7.8 (HIGH). When opening a deep link URL in SAP Fiori Client with log level set to "Debug", the client application logs the URL to the log file. If this URL contains malicious JavaScript code it can eventually ru...
How severe is CVE-2018-2491?
CVE-2018-2491 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-2491?
Check the references section above for vendor advisories and patch information. Affected products include: Sap Fiori Client.