{"api_version":"1","generated_at":"2026-07-24T01:39:46+00:00","cve":"CVE-2018-2367","urls":{"html":"https://cve.report/CVE-2018-2367","api":"https://cve.report/api/cve/CVE-2018-2367.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2018-2367","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2018-2367"},"summary":{"title":"CVE-2018-2367","description":"ABAP File Interface in, SAP BASIS, from 7.00 to 7.02, from 7.10 to 7.11, 7.30, 7.31, 7.40, from 7.50 to 7.52, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing \"traverse to parent directory\" are passed through to the file APIs.","state":"PUBLIC","assigner":"cna@sap.com","published_at":"2018-03-01 17:29:00","updated_at":"2018-03-23 16:44:00"},"problem_types":["CWE-22"],"metrics":[],"references":[{"url":"https://launchpad.support.sap.com/#/notes/2562089","name":"https://launchpad.support.sap.com/#/notes/2562089","refsource":"CONFIRM","tags":["Permissions Required"],"title":"","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/","name":"https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/","refsource":"CONFIRM","tags":["Vendor Advisory"],"title":"SAP Security Patch Day – February 2018 | SAP Blogs","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/103006","name":"103006","refsource":"BID","tags":["Third Party Advisory","VDB Entry"],"title":"SAP ABAP File Interface CVE-2018-2367 Directory Traversal Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-2367","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-2367","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2018","cve_id":"2367","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"sap","cpe5":"business_application_software_integrated_solution","cpe6":"7.30","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2018","cve_id":"2367","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"sap","cpe5":"business_application_software_integrated_solution","cpe6":"7.31","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2018","cve_id":"2367","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"sap","cpe5":"business_application_software_integrated_solution","cpe6":"7.40","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2018","cve_id":"2367","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"sap","cpe5":"business_application_software_integrated_solution","cpe6":"7.30","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2018","cve_id":"2367","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"sap","cpe5":"business_application_software_integrated_solution","cpe6":"7.31","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2018","cve_id":"2367","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"sap","cpe5":"business_application_software_integrated_solution","cpe6":"7.40","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2018","cve_id":"2367","vulnerable":"1","versionEndIncluding":"7.02","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"sap","cpe5":"business_application_software_integrated_solution","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2018","cve_id":"2367","vulnerable":"1","versionEndIncluding":"7.11","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"sap","cpe5":"business_application_software_integrated_solution","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2018","cve_id":"2367","vulnerable":"1","versionEndIncluding":"7.52","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"sap","cpe5":"business_application_software_integrated_solution","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"cna@sap.com","ID":"CVE-2018-2367","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"SAP BASIS (ABAP File Interface)","version":{"version_data":[{"version_affected":"=","version_value":"from 7.00 to 7.02"},{"version_affected":"=","version_value":"from 7.10 to 7.11"},{"version_affected":"=","version_value":"7.30"},{"version_affected":"=","version_value":"7.31"},{"version_affected":"=","version_value":"7.40"},{"version_affected":"=","version_value":"from 7.50 to 7.52"}]}}]},"vendor_name":"SAP SE"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"ABAP File Interface in, SAP BASIS, from 7.00 to 7.02, from 7.10 to 7.11, 7.30, 7.31, 7.40, from 7.50 to 7.52, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing \"traverse to parent directory\" are passed through to the file APIs."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Directory Traversal"}]}]},"references":{"reference_data":[{"name":"https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/","refsource":"CONFIRM","url":"https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/"},{"name":"103006","refsource":"BID","url":"http://www.securityfocus.com/bid/103006"},{"name":"https://launchpad.support.sap.com/#/notes/2562089","refsource":"CONFIRM","url":"https://launchpad.support.sap.com/#/notes/2562089"}]}},"nvd":{"publishedDate":"2018-03-01 17:29:00","lastModifiedDate":"2018-03-23 16:44:00","problem_types":["CWE-22"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL","baseScore":6.5},"severity":"MEDIUM","exploitabilityScore":8,"impactScore":6.4,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:sap:business_application_software_integrated_solution:*:*:*:*:*:*:*:*","versionStartIncluding":"7.00","versionEndIncluding":"7.02","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:sap:business_application_software_integrated_solution:7.30:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:sap:business_application_software_integrated_solution:7.31:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:sap:business_application_software_integrated_solution:7.40:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:sap:business_application_software_integrated_solution:*:*:*:*:*:*:*:*","versionStartIncluding":"7.50","versionEndIncluding":"7.52","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:sap:business_application_software_integrated_solution:*:*:*:*:*:*:*:*","versionStartIncluding":"7.10","versionEndIncluding":"7.11","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2018","CveId":"2367","Ordinal":"117922","Title":"CVE-2018-2367","CVE":"CVE-2018-2367","Year":"2018"},"notes":[{"CveYear":"2018","CveId":"2367","Ordinal":"1","NoteData":"ABAP File Interface in, SAP BASIS, from 7.00 to 7.02, from 7.10 to 7.11, 7.30, 7.31, 7.40, from 7.50 to 7.52, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing \"traverse to parent directory\" are passed through to the file APIs.","Type":"Description","Title":null},{"CveYear":"2018","CveId":"2367","Ordinal":"2","NoteData":"2018-03-01","Type":"Other","Title":"Published"},{"CveYear":"2018","CveId":"2367","Ordinal":"3","NoteData":"2018-03-02","Type":"Other","Title":"Modified"}]}}}