CVE-2018-2380

SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing "traverse to parent directory" are passed through to the file APIs.

Affected

SAP SE · SAP CRM

CVSS v3.1 NVD

6.6 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L

CVSS v2.0 NVD

6.5 MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P

EPSS

28.93% chance of exploitation in the next 30 days, 98th percentile

CISA KEV

added 2021-11-03, used in ransomware campaigns

Published

2018-03-01

Updated

2025-10-21

Proof-of-concept exploits (1)

• erpscanteam/CVE-2018-238052★ · 2018-03-14

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/44292

Security advisories

• https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018
• http://www.securityfocus.com/bid/103001

References

• CVE Record
• NVD entry

Related

• CVE-2018-2636