CVE-2018-2491

Name of the Vulnerable Software and Affected Versions SAP Fiori Client versions prior to 1.11.5

Description The issue allows malicious JavaScript code embedded in a deep link URL to run inside the application's built-in log viewer when the log level is set to "Debug" and the user opens the viewer and taps on the hyperlink.

Recommendations For versions prior to 1.11.5, update to version 1.11.5 to resolve the issue. As a temporary workaround, consider avoiding the use of the "Debug" log level and refrain from tapping on hyperlinks in the log viewer until the update is applied.