VULNERABILITY INTELLIGENCE

CVE-2018-2485

CVSS score7.7 HIGH

EPSS probability1.18%

CISA KEVNot currently listed

Published2018-11-13

Last modified2026-06-17

CVSS vectorCVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Description

It is possible for a malicious application or malware to execute JavaScript in a SAP Fiori application. This can include reading and writing of information and calling device specific JavaScript APIs in the application. SAP Fiori Client version 1.11.5 in Google Play store addresses these issues and users must update to that version.

Primary references

cna@sap.com — Third Party Advisory, VDB Entry
cna@sap.com — Permissions Required, Vendor Advisory
cna@sap.com — Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108 — Permissions Required, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory