Description
SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing "traverse to parent directory" are passed through to the file APIs.
Metrics
CVSS 3.1 6.6/10
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:LWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| SAP SE | SAP CRM | 7.01; 7.02; 7.30; 7.31; 7.33; 7.54 |
References
- http://www.securityfocus.com/bid/103001Broken Link, Third Party Advisory, VDB Entry
- https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/Vendor Advisory
- https://github.com/erpscanteam/CVE-2018-2380Exploit, Third Party Advisory
- https://launchpad.support.sap.com/#/notes/2547431Permissions Required
- https://www.exploit-db.com/exploits/44292/Exploit, Third Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/103001Broken Link, Third Party Advisory, VDB Entry
- https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/Vendor Advisory
- https://github.com/erpscanteam/CVE-2018-2380Exploit, Third Party Advisory
- https://launchpad.support.sap.com/#/notes/2547431Permissions Required
- https://www.exploit-db.com/exploits/44292/Exploit, Third Party Advisory, VDB Entry
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-2380US Government Resource
Timeline
- Published
- Mar 1, 2018
- Last modified
- Jun 17, 2026
- Added to CISA KEV
- Nov 3, 2021
- NVD status
- Analyzed