7.7high
CVE-2018-2485
It is possible for a malicious application or malware to execute JavaScript in a SAP Fiori application.
Published 7 y ago · modified 4 mo ago · JSON
CVSS
7.7
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.2%
percentile 68%
Public exploits
0
none known
Summary
It is possible for a malicious application or malware to execute JavaScript in a SAP Fiori application. This can include reading and writing of information and calling device specific JavaScript APIs in the application. SAP Fiori Client version 1.11.5 in Google Play store addresses these issues and users must update to that version.
Exploit prediction (EPSS)
1.18% probability of exploitation in the next 30 days, higher than 68% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 7.7 | CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
| NVD | 2.0 | 6.4 | AV:N/AC:L/Au:N/C:P/I:P/A:N |
Affected products
- SAP SAP Fiori Client
References
- securityfocus.com /bid/105911 · vdb-entry, x_refsource_BID, x_transferred
- launchpad.support.sap.com /#/notes/2691126 · x_refsource_MISC, x_transferred
- wiki.scn.sap.com /wiki/pages/viewpage.action?pageId=503809832 · x_refsource_MISC, x_transferred
Sources
- CVE List: CVE-2018-2485
- NVD: CVE-2018-2485
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.