| Package | Affected versions | Patched versions |
|---|---|---|
| approuter | < 21.2.0 | 21.2.0 |
| @sap/approuter | < 21.2.0 | 21.2.0 |
SAP Approuter does not properly validate incoming request headers during the OAuth2 login flow under certain configurations. This allows an unauthenticated remote attacker to craft a malicious link which, when clicked by a victim, could lead to unauthorized access. Successful exploitation results in a high impact to the confidentiality and integrity with no impact on the availability of the application.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free