CVE-2018-2380
Published 2018-03-01 · Updated 2026-06-17 · Source cna@sap.com
Summary
CVE-2018-2380 is a medium-severity (CVSS 6.6) vulnerability in SAP Customer Relationship Management (CRM). CISA added it to the Known Exploited Vulnerabilities catalog on November 3, 2021, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by May 3, 2022. CISA also lists it as known to be used in ransomware campaigns, so it should be prioritised accordingly. SAP has 14 vulnerabilities in the KEV catalog, 3 of them linked to ransomware.
All 14 known-exploited SAP vulnerabilities →Description
SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing "traverse to parent directory" are passed through to the file APIs.
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
CISA Known-Exploited Vulnerability
Product: SAP — Customer Relationship Management (CRM)
Name: SAP Customer Relationship Management (CRM) Path Traversal Vulnerability
Date added: 2021-11-03 · Due: 2022-05-03
Required action: Apply updates per vendor instructions.
References
- http://www.securityfocus.com/bid/103001
- https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/
- https://github.com/erpscanteam/CVE-2018-2380
- https://launchpad.support.sap.com/#/notes/2547431
- https://www.exploit-db.com/exploits/44292/
- http://www.securityfocus.com/bid/103001
- https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/
- https://github.com/erpscanteam/CVE-2018-2380