CVE-2018-2380

MEDIUMCISA KEV

6.6

Description

SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing "traverse to parent directory" are passed through to the file APIs.

CVE Details

CVSS v3.1 Score6.6

SeverityMEDIUM

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredHIGH

User InteractionNONE

Published3/1/2018

Last Modified10/31/2025

Sourcekev

Honeypot Sightings0

CISA KEV

VendorSAP

ProductCustomer Relationship Management (CRM)

Vulnerability NameSAP Customer Relationship Management (CRM) Path Traversal Vulnerability

KEV Date Added2021-11-03

Remediation Due Date2022-05-03

Ransomware UseKnown

Affected Products

sap:customer_relationship_management

Weaknesses (CWE)

CWE-22CWE-22

References

http://www.securityfocus.com/bid/103001(cna@sap.com)

https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/(cna@sap.com)

https://github.com/erpscanteam/CVE-2018-2380(cna@sap.com)

https://launchpad.support.sap.com/#/notes/2547431(cna@sap.com)

https://www.exploit-db.com/exploits/44292/(cna@sap.com)

http://www.securityfocus.com/bid/103001(af854a3a-2127-422b-91ae-364da2661108)

https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/erpscanteam/CVE-2018-2380(af854a3a-2127-422b-91ae-364da2661108)

https://launchpad.support.sap.com/#/notes/2547431(af854a3a-2127-422b-91ae-364da2661108)

https://www.exploit-db.com/exploits/44292/(af854a3a-2127-422b-91ae-364da2661108)

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-2380(134c704f-9b21-4f2e-91b3-4a467353bcc0)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.