CVE-2018-2380
Summary
| CVE | CVE-2018-2380 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2018-03-01 17:29:00 UTC |
| Updated | 2018-03-23 16:39:00 UTC |
| Description | SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing "traverse to parent directory" are passed through to the file APIs. |
Risk And Classification
EPSS: 0.288920000 probability, percentile 0.979550000 (date 2026-07-22)
CISA KEV: Listed on 2021-11-03; due 2022-05-03; ransomware use Known
Problem Types: CWE-22
CISA Known Exploited Vulnerability
| Vendor | SAP |
|---|---|
| Product | Customer Relationship Management (CRM) |
| Name | SAP Customer Relationship Management (CRM) Path Traversal Vulnerability |
| Required Action | Apply updates per vendor instructions. |
| Notes | https://nvd.nist.gov/vuln/detail/CVE-2018-2380 |
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Sap | Customer Relationship Management | 7.01 | All | All | All |
| Application | Sap | Customer Relationship Management | 7.02 | All | All | All |
| Application | Sap | Customer Relationship Management | 7.30 | All | All | All |
| Application | Sap | Customer Relationship Management | 7.31 | All | All | All |
| Application | Sap | Customer Relationship Management | 7.33 | All | All | All |
| Application | Sap | Customer Relationship Management | 7.54 | All | All | All |
| Application | Sap | Customer Relationship Management | 7.01 | All | All | All |
| Application | Sap | Customer Relationship Management | 7.02 | All | All | All |
| Application | Sap | Customer Relationship Management | 7.30 | All | All | All |
| Application | Sap | Customer Relationship Management | 7.31 | All | All | All |
| Application | Sap | Customer Relationship Management | 7.33 | All | All | All |
| Application | Sap | Customer Relationship Management | 7.54 | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| GitHub - erpscanteam/CVE-2018-2380: PoC of Remote Command Execution via Log injection on SAP NetWeaver AS JAVA CRM | MISC | github.com | Exploit, Third Party Advisory |
| SAP Customer Relationship Management CVE-2018-2380 Directory Traversal Vulnerability | BID | www.securityfocus.com | Third Party Advisory, VDB Entry |
| launchpad.support.sap.com | CONFIRM | launchpad.support.sap.com | Permissions Required |
| SAP NetWeaver AS JAVA CRM - Log injection Remote Command Execution - Windows remote Exploit | EXPLOIT-DB | www.exploit-db.com | Exploit, Third Party Advisory, VDB Entry |
| SAP Security Patch Day – February 2018 | SAP Blogs | CONFIRM | blogs.sap.com | Vendor Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
| CISA Known Exploited Vulnerabilities catalog | CISA | www.cisa.gov | kev |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 87471 SAP NetWeaver AS Java Directory Traversal Vulnerability