CVE-2018-2488

HIGH

SAP Fiori Client < 1.11.5 - Denial of Service via Malicious Local Push Notification

Title source: llm
STIX 2.1

Description

It is possible for a malware application installed on an Android device to send local push notifications with an empty message to SAP Fiori Client and cause the application to crash. SAP Fiori Client version 1.11.5 in Google Play store addresses these issues and users must update to that version.

References (2)

Core 2
Core References
Permissions Required, Vendor Advisory x_refsource_misc
https://launchpad.support.sap.com/#/notes/2691126

Scores

CVSS v3 7.8
EPSS 0.0019
EPSS Percentile 40.3%
Attack Vector LOCAL
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

Status published
Products (1)
sap/fiori_client < 1.11.5
Published Nov 13, 2018
Tracked Since Feb 18, 2026