Improper Access Control in SAP Fiori Front End Server

The vulnerability in SAP Fiori Front End Server allows an attacker to manipulate the approver details associated with leave requests. This manipulation could result in requests being routed to unintended recipients, potentially bypassing approval workflows or leading to incorrect approvals. While the impact on availability is minimal, the compromise of confidentiality and integrity could have operational consequences, such as incorrect personnel management or unauthorized access to sensitive information. The attacker would need to exploit the application's input validation mechanisms to successfully alter the approver details. This vulnerability highlights the importance of robust input validation and access controls within enterprise applications.

Organizations utilizing SAP Fiori Front End Server version 605, particularly those with complex leave request approval workflows, are at risk. Environments with limited access controls or inadequate input validation are especially vulnerable.

• linux / server:

journalctl -u fiori -g "leave request"

• generic web:

curl -I https://<fiori_server>/ | grep -i 'approver:'

1. 2024-03-12Disclosure

   disclosure

1. Reservado2024-01-05
2. Publicada2024-03-12
3. Modificada2024-08-01
4. EPSS atualizado2026-04-02

The primary mitigation for CVE-2024-22133 is to upgrade the SAP Fiori Front End Server to version 605.0.1 or later. Before upgrading, it is recommended to review SAP's upgrade documentation and perform thorough testing in a non-production environment to ensure compatibility and avoid any disruption to business operations. If an immediate upgrade is not feasible, consider implementing stricter access controls and input validation rules within the application to limit the potential for manipulation. Monitor application logs for any suspicious activity related to leave request approvals.