CVE-2018-2489

HIGH

SAP Fiori Client < 1.11.5 - Unauthenticated SSO Configuration Deletion

Title source: llm
STIX 2.1

Description

Locally, without any permission, an arbitrary android application could delete the SSO configuration of SAP Fiori Client. SAP Fiori Client version 1.11.5 in Google Play store addresses these issues and users must update to that version.

References (2)

Core 2
Core References
Release Notes, Vendor Advisory x_refsource_misc
https://launchpad.support.sap.com/#/notes/2691126

Scores

CVSS v3 7.8
EPSS 0.0087
EPSS Percentile 54.1%
Attack Vector LOCAL
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-732
Status published
Products (1)
sap/fiori_client < 1.11.5
Published Nov 13, 2018
Tracked Since Feb 18, 2026