CVE-2025-23191: Cache Poisoning through header manipulation vulnerability in SAP Fiori for SAP ERP
First published: Tue Feb 11 2025(Updated: )
Cached values belonging to the SAP OData endpoint in SAP Fiori for SAP ERP could be poisoned by modifying the Host header value in an HTTP GET request. An attacker could alter the `atom:link` values in the returned metadata redirecting them from the SAP server to a malicious link set by the attacker. Successful exploitation could cause low impact on integrity of the application.
Credit: cna@sap.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| SAP Fiori Apps for Travel Management in SAP ERP |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2025-23191?
CVE-2025-23191 is classified as a high severity vulnerability due to the potential for attacker exploitation.
How do I fix CVE-2025-23191?
To fix CVE-2025-23191, update to the latest patches provided by SAP for Fiori for SAP ERP.
What impact does CVE-2025-23191 have on SAP Fiori for SAP ERP?
CVE-2025-23191 allows for the poisoning of cached values in OData endpoints, potentially redirecting users to malicious links.
Is CVE-2025-23191 easily exploitable?
Yes, CVE-2025-23191 can be easily exploited by manipulating the Host header in HTTP GET requests.
Does CVE-2025-23191 affect all versions of SAP Fiori for SAP ERP?
CVE-2025-23191 impacts all versions of SAP Fiori for SAP ERP that do not have the latest security patches.
- agent/title
- agent/type
- agent/references
- agent/description
- agent/first-publish-date
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/author
- agent/severity
- agent/weakness
- agent/event
- agent/source
- agent/tags
- collector/epss-latest
- source/FIRST
- agent/epss
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/sap
- canonical/sap fiori apps for travel management in sap erp