SAP Fiori vulnerabilities

4 CVEs affecting SAP Fiori, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-25643, published 2024-02-13.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2018-2474, published 2018-10-09. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. SAP Fiori 1.0 for SAP ERP HCM (Approve Leave Request, version 2) application allows an attacker to trick an authenticated user to send unintended request to the web server. This vulnerability is due…
CVE-2020-6266, published 2020-06-10. Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days. SAP Fiori for SAP S/4HANA, versions - 100, 200, 300, 400, allows an attacker to redirect users to a malicious site due to insufficient URL validation, leading to URL Redirection.
CVE-2023-24528, published 2023-02-14. Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days. SAP Fiori apps for Travel Management in SAP ERP (My Travel Requests) - version 600, allows an authenticated attacker to exploit a certain misconfigured application endpoint to view sensitive data.…
CVE-2024-25643, published 2024-02-13. Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days. The SAP Fiori app (My Overtime Request) - version 605, does not perform the necessary authorization checks for an authenticated user which may result in an escalation of privileges. It is possible to…