{"api_version":"1","generated_at":"2026-07-23T06:39:33+00:00","cve":"CVE-2018-2474","urls":{"html":"https://cve.report/CVE-2018-2474","api":"https://cve.report/api/cve/CVE-2018-2474.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2018-2474","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2018-2474"},"summary":{"title":"CVE-2018-2474","description":"SAP Fiori 1.0 for SAP ERP HCM (Approve Leave Request, version 2) application allows an attacker to trick an authenticated user to send unintended request to the web server. This vulnerability is due to insufficient CSRF protection.","state":"PUBLIC","assigner":"cna@sap.com","published_at":"2018-10-09 13:29:00","updated_at":"2019-01-04 15:27:00"},"problem_types":["CWE-352"],"metrics":[],"references":[{"url":"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=500633095","name":"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=500633095","refsource":"CONFIRM","tags":["Vendor Advisory"],"title":"SAP Security Patch Day – October 2018 - Product Security Response at SAP - SCN Wiki","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/105534","name":"105534","refsource":"BID","tags":["Third Party Advisory","VDB Entry"],"title":"SAP Fiori CVE-2018-2474 Cross Site Request Forgery Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://launchpad.support.sap.com/#/notes/2696889","name":"https://launchpad.support.sap.com/#/notes/2696889","refsource":"MISC","tags":["Permissions Required"],"title":"","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-2474","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-2474","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2018","cve_id":"2474","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"sap","cpe5":"fiori","cpe6":"1.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"erp_hcm","cpe12":"*","cpe13":"*"},{"cve_year":"2018","cve_id":"2474","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"sap","cpe5":"fiori","cpe6":"1.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"erp_hcm","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"cna@sap.com","ID":"CVE-2018-2474","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"SAP Fiori 1.0 for SAP ERP HCM (Approve Leave Request, version 2)","version":{"version_data":[{"version_affected":"=","version_value":"1.0"}]}}]},"vendor_name":"SAP"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"SAP Fiori 1.0 for SAP ERP HCM (Approve Leave Request, version 2) application allows an attacker to trick an authenticated user to send unintended request to the web server. This vulnerability is due to insufficient CSRF protection."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Cross-Site Request Forgery"}]}]},"references":{"reference_data":[{"name":"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=500633095","refsource":"CONFIRM","url":"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=500633095"},{"name":"105534","refsource":"BID","url":"http://www.securityfocus.com/bid/105534"},{"name":"https://launchpad.support.sap.com/#/notes/2696889","refsource":"MISC","url":"https://launchpad.support.sap.com/#/notes/2696889"}]},"source":{"discovery":"UNKNOWN"}},"nvd":{"publishedDate":"2018-10-09 13:29:00","lastModifiedDate":"2019-01-04 15:27:00","problem_types":["CWE-352"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM"},"exploitabilityScore":2.8,"impactScore":3.6},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE","baseScore":4.3},"severity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:sap:fiori:1.0:*:*:*:*:erp_hcm:*:*","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2018","CveId":"2474","Ordinal":"118029","Title":"CVE-2018-2474","CVE":"CVE-2018-2474","Year":"2018"},"notes":[{"CveYear":"2018","CveId":"2474","Ordinal":"1","NoteData":"SAP Fiori 1.0 for SAP ERP HCM (Approve Leave Request, version 2) application allows an attacker to trick an authenticated user to send unintended request to the web server. This vulnerability is due to insufficient CSRF protection.","Type":"Description","Title":null},{"CveYear":"2018","CveId":"2474","Ordinal":"2","NoteData":"2018-10-09","Type":"Other","Title":"Published"},{"CveYear":"2018","CveId":"2474","Ordinal":"3","NoteData":"2018-10-10","Type":"Other","Title":"Modified"}]}}}