CVE-2018-2489

Severity: high (CVSS 7.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-11-13 · updated 2026-06-17
Weakness: CWE-732

Description

Locally, without any permission, an arbitrary android application could delete the SSO configuration of SAP Fiori Client. SAP Fiori Client version 1.11.5 in Google Play store addresses these issues and users must update to that version.

Affected products

SAP Fiori Client: before 1.11.5 — fixed in 1.11.5

How to fix

Upgrade to a fixed version: SAP Fiori Client 1.11.5. Check the vendor advisory for mitigations.

References

https://launchpad.support.sap.com/#/notes/2691126
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=503809832
https://launchpad.support.sap.com/#/notes/2691126
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=503809832

Get alerted when CVE-2018-2489 or the next vulnerability affects your stack