Description (CNA)
SAP Fiori Launchpad does not sufficiently validate certain user-controlled input. An unauthenticated attacker could craft a malicious link that, when clicked by an authenticated user, causes the browser to load attacker-controlled content from an external location. This could be used to exfiltrate sensitive information from the victim's session, resulting in a high impact on confidentiality. There is no impact on integrity and availability.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| SAP_SE / SAP Fiori Launchpad | affected SAP_UI 757; affected 758; affected 816; affected SAP_BASIS 918 |
CWE
CWE-95
References
ADP enrichment
No English description supplied.
No references supplied.