CVE-2018-2491

When opening a deep link URL in SAP Fiori Client with log level set to "Debug", the client application logs the URL to the log file. If this URL contains malicious JavaScript code it can eventually run inside the built-in log viewer of the application in case user opens the viewer and taps on the hyperlink in the viewer. SAP Fiori Client version 1.11.5 in Google Play store addresses these issues and users must update to that version.

• CWE-94

• https://launchpad.support.sap.com/#/notes/2691126Permissions Required, Vendor Advisory
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=503809832Vendor Advisory
• https://launchpad.support.sap.com/#/notes/2691126Permissions Required, Vendor Advisory
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=503809832Vendor Advisory

Published

Nov 13, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-2485It is possible for a malicious application or malware to exe…
• CVE-2018-2486SAP Marketing (UICUAN (1.20, 1.30, 1.40), SAPSCORE (1.13, 1.…
• CVE-2018-2487SAP Disclosure Management 10.x allows an attacker to exploit…
• CVE-2018-2488It is possible for a malware application installed on an And…
• CVE-2018-2489Locally, without any permission, an arbitrary android applic…
• CVE-2018-2490The broadcast messages received by SAP Fiori Client are not …
• CVE-2018-2492SAML 2.0 functionality in SAP NetWeaver AS Java, does not su…7.1
• CVE-2018-2494Necessary authorization checks for an authenticated user, re…
• CVE-2018-2497The security audit log of SAP HANA, versions 1.0 and 2.0, do…
• CVE-2018-2499A security weakness in SAP Financial Consolidation Cube Desi…
• CVE-2018-2500Under certain conditions SAP Mobile Secure Android client (b…
• CVE-2018-25001An issue was discovered in the libpulse-binding crate before…6.5