⚠ Actively exploited in ransomware campaigns
This vulnerability is on the CISA Known Exploited Vulnerabilities list and has been used in known ransomware attacks. CISA required action: Apply updates per vendor instructions.. Due date: 2022-05-03.

CVE-2018-2380 — Path Traversal in SE SAP CRM

CWE-22 — Path Traversal7 documents7 sources
Severity
6.6MEDIUMNVD
EPSS
48.8%
top 2.23%
CISA KEV
KEVRansomware
Added 2021-11-03
Due 2022-05-03
Exploit
Exploited in wild
Active exploitation observed
Affected products
2
SAP SE SAP CRMSAP Customer Relationship Management
Timeline
PublishedMar 1
KEV addedNov 3
KEV dueMay 3
Latest updateMay 14
CISA Required Action: Apply updates per vendor instructions.

Description

SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing "traverse to parent directory" are passed through to the file APIs.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:LExploitability: 2.3 | Impact: 3.7

Affected Packages2 packages

▶CVEListV5sap_se/sap_crm6 versions+5

🔴Vulnerability Details

3
GHSA
GHSA-22j7-69m5-2pqh: SAP CRM, 7↗2022-05-14
▶
CVEList
CVE-2018-2380: SAP CRM, 7↗2018-03-01
▶
VulnCheck
SAP Customer Relationship Management (CRM) Path Traversal Vulnerability↗2018
▶

💥Exploits & PoCs

1
Exploit-DB
SAP NetWeaver AS JAVA CRM - Log injection Remote Command Execution↗2018-03-14
▶

🔍Detection Rules

1
Suricata
ET EXPLOIT SAP NetWeaver AS JAVA CRM - Log injection Remote Command Execution↗2018-07-12
▶

📋Vendor Advisories

1
CISA
SAP Customer Relationship Management (CRM) Path Traversal Vulnerability↗2021-11-03
▶
CVE-2018-2380 — Path Traversal in SAP SE SAP CRM | cvebase