CVE-2018-2380
SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing "traverse to parent directory" are passed through to the file APIs.
- Score
- CVSS 3.1 6.6 Medium
- Status
- Analyzed - cna@sap.com
- Published
- 2018-03-01
- Last modified
- 2025-10-21
- Known exploited (CISA KEV)
- since 2021-11-03, action due 2022-05-03: Apply updates per vendor instructions.
- Weaknesses
- CWE-22
Affected products
References
- http://www.securityfocus.com/bid/103001
- https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/
- https://github.com/erpscanteam/CVE-2018-2380
- https://launchpad.support.sap.com/#/notes/2547431
- https://www.exploit-db.com/exploits/44292/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-2380
