CVE-2023-24528

CVE-2023-24528 affects SAP Fiori apps for Travel Management in SAP ERP (My Travel Requests) version 600. The vulnerability arises from a misconfigured application endpoint that is exposed over the network, enabling an authenticated attacker to view sensitive data (e.g., travel documents). The iss...

CVE-2024-25643

CVE-2024-25643 affects the SAP Fiori app “My Overtime Request” (version 605). The issue is missing authorization checks for authenticated users, enabling potential privilege escalation by manipulating data-request URLs to access restricted information. The initial description notes no impact to i...

CVE-2018-2474

CVE-2018-2474 affects SAP Fiori 1.0 for SAP ERP HCM (Approve Leave Request, version 2). The issue is improper CSRF protection, allowing an attacker to trick an authenticated user into sending unintended requests to the web server. Root cause: insufficient CSRF defenses in the SAP Fiori applicatio...

CVE-2020-6266

The CVE-2020-6266 entry affects SAP Fiori for SAP S/4HANA, versions 100–400. The underlying issue is insufficient URL validation that enables an attacker to redirect users to a malicious site. The exposed component/behavior is URL redirection via manipulated links. Publicly visible remediation de...