CVE-2018-2488

Severity: high (CVSS 7.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-11-13 · updated 2026-06-17

Description

It is possible for a malware application installed on an Android device to send local push notifications with an empty message to SAP Fiori Client and cause the application to crash. SAP Fiori Client version 1.11.5 in Google Play store addresses these issues and users must update to that version.

Affected products

SAP Fiori Client: before 1.11.5 — fixed in 1.11.5

How to fix

Upgrade to a fixed version: SAP Fiori Client 1.11.5. Check the vendor advisory for mitigations.

References

https://launchpad.support.sap.com/#/notes/2691126
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=503809832
https://launchpad.support.sap.com/#/notes/2691126
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=503809832

Get alerted when CVE-2018-2488 or the next vulnerability affects your stack