CVE-2018-2474

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

SAP Fiori 1.0 for SAP ERP HCM (Approve Leave Request, version 2) application allows an attacker to trick an authenticated user to send unintended request to the web server. This vulnerability is due to insufficient CSRF protection.

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
SAP	SAP Fiori 1.0 for SAP ERP HCM (Approve Leave Request, version 2)	1.0

References

http://www.securityfocus.com/bid/105534Third Party Advisory, VDB Entry
https://launchpad.support.sap.com/#/notes/2696889Permissions Required
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=500633095Vendor Advisory
http://www.securityfocus.com/bid/105534Third Party Advisory, VDB Entry
https://launchpad.support.sap.com/#/notes/2696889Permissions Required
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=500633095Vendor Advisory

Timeline

Published: Oct 9, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-24758.5Following the Gardener architecture, the Kubernetes apiserver of a Gardener managed shoot cluster resides in the corresponding seed cluster.CVE-2018-24766.1Due to insufficient URL Validation in forums in SAP NetWeaver versions 7.30, 7.31, 7.40, an attacker can redirect users to a malicious site.CVE-2018-24778.8Knowledge Management (XMLForms) in SAP NetWeaver, versions 7.30, 7.31, 7.40 and 7.50 does not sufficiently validate an XML document accepted CVE-2018-24787.2An attacker can use specially crafted inputs to execute commands on the host of a TREX / BWA installation, SAP Basis, versions: 7.0 to 7.02,CVE-2018-24796.1SAP BusinessObjects Business Intelligence Platform (BIWorkspace), versions 4.1 and 4.2, does not sufficiently encode user-controlled inputs,CVE-2018-24817.2In some SAP standard roles, in SAP_ABA versions, 7.00 to 7.02, 7.10 to 7.11, 7.30, 7.31, 7.40, 7.50, 75C to 75D, a transaction code reserved CVE-2018-24827.5SAP Mobile Secure Android Application, Mobile-secure.apk Android client, before version 6.60.19942.0, allows an attacker to prevent legitima CVE-2018-24834.3HTTP Verb Tampering is possible in SAP BusinessObjects Business Intelligence Platform, versions 4.1 and 4.2, Central Management Console (CMC CVE-2018-24848.8SAP Enterprise Financial Services (fixed in SAPSCORE 1.13, 1.14, 1.15; S4CORE 1.01, 1.02, 1.03; EA-FINSERV 1.10, 2.0, 5.0, 6.0, 6.03, 6.04, CVE-2018-24857.7It is possible for a malicious application or malware to execute JavaScript in a SAP Fiori application. This can include reading and writing CVE-2018-24865.4SAP Marketing (UICUAN (1.20, 1.30, 1.40), SAPSCORE (1.13, 1.14)) does not sufficiently encode user-controlled inputs, resulting in Cross-Sit CVE-2018-24878.3SAP Disclosure Management 10.x allows an attacker to exploit through a specially crafted zip file provided by users: When extracted in speci