SAP Fiori Launchpad Credential Theft Vulnerability via Malicious URLs

A vulnerability in SAP Fiori Launchpad allows attackers to create malicious URLs that trigger arbitrary service calls within the Fiori domain. When these URLs are opened by users, they could lead to the theft of user credentials, compromising accounts. Exploitation of this vulnerability requires advanced knowledge of the system, resulting in a low impact on confidentiality and integrity, with no effect on availability.

Impact

Successful exploitation could result in the theft of user credentials, allowing attackers to compromise user accounts.

Remediation

Users are advised to consult the SAP Security Notes for guidance on addressing this vulnerability. SAP Security Notes can be accessed through the SAP for Me platform.