CVEvulnerability

CVE-2018-2380

6.6 MEDIUM Known exploited Published 2018-03-01 Modified 2026-06-17 Official page ↗

CISA Known Exploited Vulnerability

SAP Customer Relationship Management (CRM) Path Traversal Vulnerability — SAP Customer Relationship Management (CRM)

SAP Customer Relationship Management (CRM) contains a path traversal vulnerability that allows an attacker to exploit insufficient validation of path information provided by users.

Added to KEV
2021-11-03
Remediation due
2022-05-03
Ransomware use
Known
Required action
Apply updates per vendor instructions.
Notes
https://nvd.nist.gov/vuln/detail/CVE-2018-2380
Status
Analyzed
Published
2018-03-01
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.6 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
6.6 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
CVSS 2.0 ([email protected])
6.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:P
Weaknesses
CWE-22

Description

SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing "traverse to parent directory" are passed through to the file APIs.

Affected configurations

• sap customer relationship management 7.01 • sap customer relationship management 7.02 • sap customer relationship management 7.30 • sap customer relationship management 7.31 • sap customer relationship management 7.33 • sap customer relationship management 7.54

Related

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References