CVE-2018-2474

SAP Fiori 1.0 for SAP ERP HCM (Approve Leave Request, version 2) application allows an attacker to trick an authenticated user to send unintended request to the web server. This vulnerability is due to insufficient CSRF protection.

Score

CVSS 3.0 6.5 Medium

Status

Modified - cna@sap.com

Published

2018-10-09

Last modified

2024-08-05

Weaknesses

CWE-352

Affected products

• Fiori (Sap)
• Sap Fiori 1.0 For Sap Erp Hcm Approve Leave Request (Sap)
• Version 2 (Sap)

References

• http://www.securityfocus.com/bid/105534
• https://launchpad.support.sap.com/#/notes/2696889
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=500633095