CVE-2018-2474: SAP Fiori

Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days.

SAP Fiori 1.0 for SAP ERP HCM (Approve Leave Request, version 2) application allows an attacker to trick an authenticated user to send unintended request to the web server. This vulnerability is due to insufficient CSRF protection.

Affected products

• SAP Fiori: version 1.0 only

Published 2018-10-09. Last modified 2026-06-17.