Fiori

fiori

Vendor: Sap • 4 CVEs

CVEs (4)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2024-25643 1Sap 1Fiori Jun 17, 2026 Feb 13, 2024 N/A· v4 4.3 MEDIUM· v3 N/A· v2 The SAP Fiori app (My Overtime Request) - version 605, does not perform the necessary authorization checks for an authenticated user which may result in an escalation of privileges. It is possible to manipulate the URLs...Show more The SAP Fiori app (My Overtime Request) - version 605, does not perform the necessary authorization checks for an authenticated user which may result in an escalation of privileges. It is possible to manipulate the URLs of data requests to access information that the user should not have access to. There is no impact on integrity and availability.Show less
CVE-2023-24528 1Sap 1Fiori Jun 17, 2026 Feb 14, 2023 N/A· v4 6.5 MEDIUM· v3 N/A· v2 SAP Fiori apps for Travel Management in SAP ERP (My Travel Requests) - version 600, allows an authenticated attacker to exploit a certain misconfigured application endpoint to view sensitive data. This endpoint is norma...Show more SAP Fiori apps for Travel Management in SAP ERP (My Travel Requests) - version 600, allows an authenticated attacker to exploit a certain misconfigured application endpoint to view sensitive data. This endpoint is normally exposed over the network and successful exploitation can lead to exposure of data like travel documents. Show less
CVE-2020-6266 1Sap 1Fiori Jun 17, 2026 Jun 10, 2020 N/A· v4 5.4 MEDIUM· v3 4.9 MEDIUM· v2 SAP Fiori for SAP S/4HANA, versions - 100, 200, 300, 400, allows an attacker to redirect users to a malicious site due to insufficient URL validation, leading to URL Redirection.
CVE-2018-2474 1Sap 1Fiori Nov 21, 2024 Oct 9, 2018 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 SAP Fiori 1.0 for SAP ERP HCM (Approve Leave Request, version 2) application allows an attacker to trick an authenticated user to send unintended request to the web server. This vulnerability is due to insufficient CSRF...Show more SAP Fiori 1.0 for SAP ERP HCM (Approve Leave Request, version 2) application allows an attacker to trick an authenticated user to send unintended request to the web server. This vulnerability is due to insufficient CSRF protection.Show less