{"id":"CVE-2018-2474","aliases":["EUVD-2018-14329","GHSA-6mvm-9rrh-j4gc"],"status":"published","title":"SAP Fiori 1.0 for SAP ERP HCM (Approve Leave Request, version 2) application allows an attacker...","description":"SAP Fiori 1.0 for SAP ERP HCM (Approve Leave Request, version 2) application allows an attacker to trick an authenticated user to send unintended request to the web server. This vulnerability is due to insufficient CSRF protection.","severity":{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.00669,"percentile":0.522,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-352"],"published":"2018-10-09T13:00:00Z","modified":"2026-06-17T01:55:45Z","products":[{"vendor":"sap","product":"fiori"},{"vendor":"sap","product":"sap fiori 1.0 for sap erp hcm (approve leave request, version 2)"}],"references":[{"url":"https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=500633095","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/105534","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"https://launchpad.support.sap.com/#/notes/2696889","tags":["x_refsource_MISC","x_transferred","Permissions Required"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-2474"},{"url":"https://github.com/advisories/GHSA-6mvm-9rrh-j4gc"}],"sources":{"cve":[{"id":"CVE-2018-2474","description":"SAP Fiori 1.0 for SAP ERP HCM (Approve Leave Request, version 2) application allows an attacker to trick an authenticated user to send unintended request to the web server. This vulnerability is due to insufficient CSRF protection.","status":"published","published":"2018-10-09T13:00:00Z","modified":"2024-08-05T04:21:34.147Z","updated_at":"2026-11-02T14:35:05.262903Z"}],"euvd":[{"id":"EUVD-2018-14329","description":"SAP Fiori 1.0 for SAP ERP HCM (Approve Leave Request, version 2) application allows an attacker to trick an authenticated user to send unintended request to the web server. This vulnerability is due to insufficient CSRF protection.","status":"published","published":"2018-10-09T13:00:00Z","modified":"2024-08-05T04:21:34Z","updated_at":"2026-11-03T02:40:15.759349Z"}],"ghsa":[{"id":"GHSA-6mvm-9rrh-j4gc","title":"SAP Fiori 1.0 for SAP ERP HCM (Approve Leave Request, version 2) application allows an attacker...","description":"SAP Fiori 1.0 for SAP ERP HCM (Approve Leave Request, version 2) application allows an attacker to trick an authenticated user to send unintended request to the web server. This vulnerability is due to insufficient CSRF protection.","status":"published","published":"2022-05-14T01:43:15Z","modified":"2023-02-02T05:04:24Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:51:51.657093Z"}],"nvd":[{"id":"CVE-2018-2474","description":"SAP Fiori 1.0 for SAP ERP HCM (Approve Leave Request, version 2) application allows an attacker to trick an authenticated user to send unintended request to the web server. This vulnerability is due to insufficient CSRF protection.","status":"published","published":"2018-10-09T13:29:02.133Z","modified":"2026-06-17T01:55:45.367Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:04:44.873741Z"}]}}