CVE-2026-24315
SAP Fiori Launchpad allows attackers to craft malicious URLs that triggers arbitrary service calls on the Fiori domain, this when opened by the user could compromise accounts by stealing user credentials. Successful exploitation requires adversaries to possess advanced knowledge of the system causing low impact on Confidentiality and Integrity. Availability of the system is no impacted.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 4.2
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
- EPSS probability
- 0.17%
- CWE
- CWE-35
- Published
- 2026-06-09
- Last modified
- 2026-06-09
Affected products
- SAP_SE SAP Fiori (launchpad)
- SAP_SE SAP Fiori (launchpad)
- SAP_SE SAP Fiori (launchpad)
- SAP_SE SAP Fiori (launchpad)
- SAP_SE SAP Fiori (launchpad)
- SAP_SE SAP Fiori (launchpad)
Weakness type
Related vulnerabilities
- CVE-2026-20513 — In Audio HAL, there is a possible information disclosure due to improper input validation. This...
- CVE-2026-56089 — Dell ObjectScale, versions prior to 4.3.0.1, contain(s) a Path Traversal vulnerability. A low...
- CVE-2026-59909 — Dell ObjectScale, versions prior to 4.3.0.1, contain(s) a Path Traversal vulnerability. A low...
- CVE-2026-28157 — WordPress Do Lasso plugin <= 358 - Path Traversal vulnerability
- CVE-2026-69109 — A vulnerability has been identified in Siemens License Server (SLS) (All versions < V5.3). The...
- CVE-2026-13716 — Path Traversal: '.../...//' in Crafty Controller
- CVE-2026-59115 — Microsoft Entra Provisioning Service Elevation of Privilege Vulnerability
- CVE-2026-66695 — WordPress W3 Total Cache plugin <= 2.10.2 - Path Traversal vulnerability