Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2018-2459: SAP Mobile Platform 3.0 may display another user's data
CVE-2018-2459 · published 8 years ago
Summary
The offline OData feature in SAP Mobile Platform version 3.0 can sometimes mix up data, showing information that belongs to a different user. This could lead to privacy concerns or incorrect decisions based on the wrong data. Turn off the delta‑token option or apply the vendor's update to ensure each user only sees their own records.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| sap | mobile_platform |
3.0 cpe:2.3:a:sap:mobile_platform:3.0:*:*:*:*:*:*:* |
Original advisory text
Users of an SAP Mobile Platform (version 3.0) Offline OData application, which uses Offline OData-supplied delta tokens (which is on by default), occasionally receive some data values of a differen...
Users of an SAP Mobile Platform (version 3.0) Offline OData application, which uses Offline OData-supplied delta tokens (which is on by default), occasionally receive some data values of a different user.
References
- http://www.securityfocus.com/bid/105338 Third Party Advisory VDB Entry
- https://launchpad.support.sap.com/#/notes/2672919 Permissions Required Vendor Advisory
- https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=499356993 Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published11 Sep 2018
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2018-2459 · NVD
Track software like this
Free during beta