CVE-2018-2380 SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing "traverse to parent directory" are...
MediumCVSS 6.6
EPSS 28.9%
CISA KEV
added 2021-11-03 · due 2022-05-03
Ransomware
Exploited in the wild
Public exploit
- Published
- Updated
- Exploit status
- Exploited in the wild (confirmed)
Description
SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing "traverse to parent directory" are passed through to the file APIs.
CISA Known Exploited Vulnerability
- Date added
- 2021-11-03
- Due date (FCEB)
- 2022-05-03
- Ransomware use
- Known
Required action
Apply updates per vendor instructions.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sap customer relationship management | = 7.01 | No fix listed |
| sap customer relationship management | = 7.02 | No fix listed |
| sap customer relationship management | = 7.30 | No fix listed |
| sap customer relationship management | = 7.31 | No fix listed |
| sap customer relationship management | = 7.33 | No fix listed |
| sap customer relationship management | = 7.54 | No fix listed |
| SAP_SE SAP CRM | = 7.01 | No fix listed |
| SAP_SE SAP CRM | = 7.02 | No fix listed |
| SAP_SE SAP CRM | = 7.30 | No fix listed |
| SAP_SE SAP CRM | = 7.31 | No fix listed |
| SAP_SE SAP CRM | = 7.33 | No fix listed |
| SAP_SE SAP CRM | = 7.54 | No fix listed |
References
- 103001 broken-link third-party-advisory vdb-entry
- blogs.sap.com vendor-advisory
- github.com exploit third-party-advisory
- launchpad.support.sap.com permissions-required
- 44292 exploit third-party-advisory vdb-entry
- www.cisa.gov government-resource us-government-resource