CVE-2018-2485

HIGH

SAP Fiori Client < 1.11.5 - JavaScript Execution via Malicious Application

Title source: llm
STIX 2.1

Description

It is possible for a malicious application or malware to execute JavaScript in a SAP Fiori application. This can include reading and writing of information and calling device specific JavaScript APIs in the application. SAP Fiori Client version 1.11.5 in Google Play store addresses these issues and users must update to that version.

References (3)

Core 3
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/105911
Permissions Required, Vendor Advisory x_refsource_misc
https://launchpad.support.sap.com/#/notes/2691126

Scores

CVSS v3 7.7
EPSS 0.0021
EPSS Percentile 42.4%
Attack Vector LOCAL
CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Details

Status published
Products (1)
sap/fiori_client < 1.11.5
Published Nov 13, 2018
Tracked Since Feb 18, 2026