6.6Medium
KEV
Used in ransomware
CVE-2018-2380SAP Customer Relationship Management (CRM) Path Traversal Vulnerability
Known exploited — SAP Customer Relationship Management (CRM) Path Traversal Vulnerability
CISA confirmed this vulnerability is used in real attacks on 03.11.2021. Remediation deadline for US federal agencies: 03.05.2022.
Required action: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2018-2380
Description
SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing "traverse to parent directory" are passed through to the file APIs.
Weakness (CWE):
CWE-22
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| sap | customer relationship management | 7.01 | |
| SAP SE | SAP CRM | 7.01, 7.02, 7.30, 7.31, 7.33, 7.54 |
References and patches
- https://github.com/erpscanteam/CVE-2018-2380 ExploitThird Party Advisory
- 44292 exploitExploitThird Party AdvisoryVDB Entry
- https://launchpad.support.sap.com/#/notes/2547431
- 103001 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
- https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/ Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-2380 US Government Resource
CPE matches (NVD) (6)
cpe:2.3:a:sap:customer_relationship_management:7.01:*:*:*:*:*:*:*cpe:2.3:a:sap:customer_relationship_management:7.02:*:*:*:*:*:*:*cpe:2.3:a:sap:customer_relationship_management:7.30:*:*:*:*:*:*:*cpe:2.3:a:sap:customer_relationship_management:7.31:*:*:*:*:*:*:*cpe:2.3:a:sap:customer_relationship_management:7.33:*:*:*:*:*:*:*cpe:2.3:a:sap:customer_relationship_management:7.54:*:*:*:*:*:*:*