Vulnerability-Lookup

CVE-2018-2380 (GCVE-0-2018-2380)

Vulnerability from cvelistv5 – Published: 2018-03-01 17:00 – Updated: 2025-10-21 23:45

CISA KEV

Summary

SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing "traverse to parent directory" are passed through to the file APIs.

Severity ?

6.6 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L

CWE

Directory/Path Traversal

Assigner

sap

References

URL

	Vendor	Product	Version
	SAP SE	SAP CRM	Affected: 7.01 Affected: 7.02 Affected: 7.30 Affected: 7.31 Affected: 7.33 Affected: 7.54

CISA KEV

Known Exploited Vulnerability - GCVE BCP-07 Compliant

KEV entry ID: 3d06f017-6572-4eb8-a4ca-1eb703042721

Vulnerability ID: CVE-2018-2380

Status: Confirmed

Status Updated: 2021-11-03 00:00 UTC

Exploited: Yes

Timestamps

First Seen: 2021-11-03

Asserted: 2021-11-03

Scope

Notes: KEV entry: SAP Customer Relationship Management (CRM) Path Traversal Vulnerability | Affected: SAP / Customer Relationship Management (CRM) | Description: SAP Customer Relationship Management (CRM) contains a path traversal vulnerability that allows an attacker to exploit insufficient validation of path information provided by users. | Required action: Apply updates per vendor instructions. | Due date: 2022-05-03 | Known ransomware campaign use (KEV): Known | Notes (KEV): https://nvd.nist.gov/vuln/detail/CVE-2018-2380

Evidence

Type: Vendor Report

Signal: Successful Exploitation

Confidence: 80%

Source: cisa-kev

Details

Cwes	CWE-22
Feed	CISA Known Exploited Vulnerabilities Catalog
Product	Customer Relationship Management (CRM)
Due Date	2022-05-03
Date Added	2021-11-03
Vendorproject	SAP
Vulnerabilityname	SAP Customer Relationship Management (CRM) Path Traversal Vulnerability
Knownransomwarecampaignuse	Known

References

CVE-2018-2380

Created: 2026-02-02 12:29 UTC | Updated: 2026-02-06 07:17 UTC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T04:14:39.708Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/erpscanteam/CVE-2018-2380"
          },
          {
            "name": "44292",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "https://www.exploit-db.com/exploits/44292/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://launchpad.support.sap.com/#/notes/2547431"
          },
          {
            "name": "103001",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/103001"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 6.6,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "HIGH",
              "scope": "CHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2018-2380",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-29T20:12:55.158230Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2021-11-03",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-2380"
              },
              "type": "kev"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-22",
                "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-21T23:45:56.073Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-2380"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2021-11-03T00:00:00.000Z",
            "value": "CVE-2018-2380 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "SAP CRM",
          "vendor": "SAP SE",
          "versions": [
            {
              "status": "affected",
              "version": "7.01"
            },
            {
              "status": "affected",
              "version": "7.02"
            },
            {
              "status": "affected",
              "version": "7.30"
            },
            {
              "status": "affected",
              "version": "7.31"
            },
            {
              "status": "affected",
              "version": "7.33"
            },
            {
              "status": "affected",
              "version": "7.54"
            }
          ]
        }
      ],
      "datePublic": "2018-02-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing \"traverse to parent directory\" are passed through to the file APIs."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Directory/Path Traversal",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-03-17T09:57:01.000Z",
        "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
        "shortName": "sap"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/erpscanteam/CVE-2018-2380"
        },
        {
          "name": "44292",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "https://www.exploit-db.com/exploits/44292/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://launchpad.support.sap.com/#/notes/2547431"
        },
        {
          "name": "103001",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/103001"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cna@sap.com",
          "ID": "CVE-2018-2380",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "SAP CRM",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_value": "7.01"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "7.02"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "7.30"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "7.31"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "7.33"
                          },
                          {
                            "version_affected": "=",
                            "version_value": "7.54"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "SAP SE"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing \"traverse to parent directory\" are passed through to the file APIs."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Directory/Path Traversal"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/erpscanteam/CVE-2018-2380",
              "refsource": "MISC",
              "url": "https://github.com/erpscanteam/CVE-2018-2380"
            },
            {
              "name": "44292",
              "refsource": "EXPLOIT-DB",
              "url": "https://www.exploit-db.com/exploits/44292/"
            },
            {
              "name": "https://launchpad.support.sap.com/#/notes/2547431",
              "refsource": "CONFIRM",
              "url": "https://launchpad.support.sap.com/#/notes/2547431"
            },
            {
              "name": "103001",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/103001"
            },
            {
              "name": "https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/",
              "refsource": "CONFIRM",
              "url": "https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
    "assignerShortName": "sap",
    "cveId": "CVE-2018-2380",
    "datePublished": "2018-03-01T17:00:00.000Z",
    "dateReserved": "2017-12-15T00:00:00.000Z",
    "dateUpdated": "2025-10-21T23:45:56.073Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "cisa_known_exploited": {
      "cveID": "CVE-2018-2380",
      "cwes": "[\"CWE-22\"]",
      "dateAdded": "2021-11-03",
      "dueDate": "2022-05-03",
      "knownRansomwareCampaignUse": "Known",
      "notes": "https://nvd.nist.gov/vuln/detail/CVE-2018-2380",
      "product": "Customer Relationship Management (CRM)",
      "requiredAction": "Apply updates per vendor instructions.",
      "shortDescription": "SAP Customer Relationship Management (CRM) contains a path traversal vulnerability that allows an attacker to exploit insufficient validation of path information provided by users.",
      "vendorProject": "SAP",
      "vulnerabilityName": "SAP Customer Relationship Management (CRM) Path Traversal Vulnerability"
    },
    "fkie_nvd": {
      "cisaActionDue": "2022-05-03",
      "cisaExploitAdd": "2021-11-03",
      "cisaRequiredAction": "Apply updates per vendor instructions.",
      "cisaVulnerabilityName": "SAP Customer Relationship Management (CRM) Path Traversal Vulnerability",
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:sap:customer_relationship_management:7.01:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"136E88EF-877A-4881-B098-3472E02FC45A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:sap:customer_relationship_management:7.02:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"3029F4DC-63CD-49C6-A98E-5A5B01E104FA\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:sap:customer_relationship_management:7.30:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"51E097C6-61E3-4D8A-ABEC-A32BA68E3D87\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:sap:customer_relationship_management:7.31:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"4258AAE6-ABD0-47C1-B794-E68D3A57EEE0\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:sap:customer_relationship_management:7.33:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"4392BD0F-A286-4AEA-89E5-D151034C9055\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:sap:customer_relationship_management:7.54:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"CFD82446-BD1D-40E7-A216-2239B7D07691\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing \\\"traverse to parent directory\\\" are passed through to the file APIs.\"}, {\"lang\": \"es\", \"value\": \"SAP CRM 7.01, 7.02, 7.30, 7.31, 7.33 y 7.54 permite que un atacante explote la validaci\\u00f3n insuficiente de la informaci\\u00f3n de ruta proporcionada por los usuarios, por lo que los caracteres que representan \\\"salto al directorio padre\\\" se pasan a las API de archivo.\"}]",
      "id": "CVE-2018-2380",
      "lastModified": "2024-11-21T04:03:42.830",
      "metrics": "{\"cvssMetricV30\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.0\", \"vectorString\": \"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L\", \"baseScore\": 6.6, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"HIGH\", \"userInteraction\": \"NONE\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"LOW\", \"availabilityImpact\": \"LOW\"}, \"exploitabilityScore\": 2.3, \"impactScore\": 3.7}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:L/Au:S/C:P/I:P/A:P\", \"baseScore\": 6.5, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"LOW\", \"authentication\": \"SINGLE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"PARTIAL\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 8.0, \"impactScore\": 6.4, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
      "published": "2018-03-01T17:29:00.413",
      "references": "[{\"url\": \"http://www.securityfocus.com/bid/103001\", \"source\": \"cna@sap.com\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/\", \"source\": \"cna@sap.com\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://github.com/erpscanteam/CVE-2018-2380\", \"source\": \"cna@sap.com\", \"tags\": [\"Exploit\", \"Third Party Advisory\"]}, {\"url\": \"https://launchpad.support.sap.com/#/notes/2547431\", \"source\": \"cna@sap.com\", \"tags\": [\"Permissions Required\"]}, {\"url\": \"https://www.exploit-db.com/exploits/44292/\", \"source\": \"cna@sap.com\", \"tags\": [\"Exploit\", \"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"http://www.securityfocus.com/bid/103001\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://github.com/erpscanteam/CVE-2018-2380\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Third Party Advisory\"]}, {\"url\": \"https://launchpad.support.sap.com/#/notes/2547431\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Permissions Required\"]}, {\"url\": \"https://www.exploit-db.com/exploits/44292/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Third Party Advisory\", \"VDB Entry\"]}]",
      "sourceIdentifier": "cna@sap.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-22\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2018-2380\",\"sourceIdentifier\":\"cna@sap.com\",\"published\":\"2018-03-01T17:29:00.413\",\"lastModified\":\"2025-10-31T22:05:53.403\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing \\\"traverse to parent directory\\\" are passed through to the file APIs.\"},{\"lang\":\"es\",\"value\":\"SAP CRM 7.01, 7.02, 7.30, 7.31, 7.33 y 7.54 permite que un atacante explote la validaci\u00f3n insuficiente de la informaci\u00f3n de ruta proporcionada por los usuarios, por lo que los caracteres que representan \\\"salto al directorio padre\\\" se pasan a las API de archivo.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L\",\"baseScore\":6.6,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":2.3,\"impactScore\":3.7},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L\",\"baseScore\":6.6,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":2.3,\"impactScore\":3.7}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:S/C:P/I:P/A:P\",\"baseScore\":6.5,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.0,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"cisaExploitAdd\":\"2021-11-03\",\"cisaActionDue\":\"2022-05-03\",\"cisaRequiredAction\":\"Apply updates per vendor instructions.\",\"cisaVulnerabilityName\":\"SAP Customer Relationship Management (CRM) Path Traversal Vulnerability\",\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-22\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-22\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:customer_relationship_management:7.01:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"136E88EF-877A-4881-B098-3472E02FC45A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:customer_relationship_management:7.02:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3029F4DC-63CD-49C6-A98E-5A5B01E104FA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:customer_relationship_management:7.30:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"51E097C6-61E3-4D8A-ABEC-A32BA68E3D87\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:customer_relationship_management:7.31:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4258AAE6-ABD0-47C1-B794-E68D3A57EEE0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:customer_relationship_management:7.33:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4392BD0F-A286-4AEA-89E5-D151034C9055\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sap:customer_relationship_management:7.54:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CFD82446-BD1D-40E7-A216-2239B7D07691\"}]}]}],\"references\":[{\"url\":\"http://www.securityfocus.com/bid/103001\",\"source\":\"cna@sap.com\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\",\"Broken Link\"]},{\"url\":\"https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/\",\"source\":\"cna@sap.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://github.com/erpscanteam/CVE-2018-2380\",\"source\":\"cna@sap.com\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://launchpad.support.sap.com/#/notes/2547431\",\"source\":\"cna@sap.com\",\"tags\":[\"Permissions Required\"]},{\"url\":\"https://www.exploit-db.com/exploits/44292/\",\"source\":\"cna@sap.com\",\"tags\":[\"Exploit\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://www.securityfocus.com/bid/103001\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\",\"Broken Link\"]},{\"url\":\"https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://github.com/erpscanteam/CVE-2018-2380\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://launchpad.support.sap.com/#/notes/2547431\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Permissions Required\"]},{\"url\":\"https://www.exploit-db.com/exploits/44292/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-2380\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"tags\":[\"US Government Resource\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://github.com/erpscanteam/CVE-2018-2380\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://www.exploit-db.com/exploits/44292/\", \"name\": \"44292\", \"tags\": [\"exploit\", \"x_refsource_EXPLOIT-DB\", \"x_transferred\"]}, {\"url\": \"https://launchpad.support.sap.com/#/notes/2547431\", \"tags\": [\"x_refsource_CONFIRM\", \"x_transferred\"]}, {\"url\": \"http://www.securityfocus.com/bid/103001\", \"name\": \"103001\", \"tags\": [\"vdb-entry\", \"x_refsource_BID\", \"x_transferred\"]}, {\"url\": \"https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/\", \"tags\": [\"x_refsource_CONFIRM\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-05T04:14:39.708Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 6.6, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"HIGH\", \"confidentialityImpact\": \"LOW\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2018-2380\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"active\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-01-29T20:12:55.158230Z\"}}}, {\"other\": {\"type\": \"kev\", \"content\": {\"dateAdded\": \"2021-11-03\", \"reference\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-2380\"}}}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2021-11-03T00:00:00.000Z\", \"value\": \"CVE-2018-2380 added to CISA KEV\"}], \"references\": [{\"url\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-2380\", \"tags\": [\"government-resource\"]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-22\", \"description\": \"CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-01-29T20:12:57.452Z\"}}], \"cna\": {\"affected\": [{\"vendor\": \"SAP SE\", \"product\": \"SAP CRM\", \"versions\": [{\"status\": \"affected\", \"version\": \"7.01\"}, {\"status\": \"affected\", \"version\": \"7.02\"}, {\"status\": \"affected\", \"version\": \"7.30\"}, {\"status\": \"affected\", \"version\": \"7.31\"}, {\"status\": \"affected\", \"version\": \"7.33\"}, {\"status\": \"affected\", \"version\": \"7.54\"}]}], \"datePublic\": \"2018-02-13T00:00:00.000Z\", \"references\": [{\"url\": \"https://github.com/erpscanteam/CVE-2018-2380\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://www.exploit-db.com/exploits/44292/\", \"name\": \"44292\", \"tags\": [\"exploit\", \"x_refsource_EXPLOIT-DB\"]}, {\"url\": \"https://launchpad.support.sap.com/#/notes/2547431\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"http://www.securityfocus.com/bid/103001\", \"name\": \"103001\", \"tags\": [\"vdb-entry\", \"x_refsource_BID\"]}, {\"url\": \"https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/\", \"tags\": [\"x_refsource_CONFIRM\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing \\\"traverse to parent directory\\\" are passed through to the file APIs.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"text\", \"description\": \"Directory/Path Traversal\"}]}], \"providerMetadata\": {\"orgId\": \"e4686d1a-f260-4930-ac4c-2f5c992778dd\", \"shortName\": \"sap\", \"dateUpdated\": \"2018-03-17T09:57:01.000Z\"}, \"x_legacyV4Record\": {\"affects\": {\"vendor\": {\"vendor_data\": [{\"product\": {\"product_data\": [{\"version\": {\"version_data\": [{\"version_value\": \"7.01\", \"version_affected\": \"=\"}, {\"version_value\": \"7.02\", \"version_affected\": \"=\"}, {\"version_value\": \"7.30\", \"version_affected\": \"=\"}, {\"version_value\": \"7.31\", \"version_affected\": \"=\"}, {\"version_value\": \"7.33\", \"version_affected\": \"=\"}, {\"version_value\": \"7.54\", \"version_affected\": \"=\"}]}, \"product_name\": \"SAP CRM\"}]}, \"vendor_name\": \"SAP SE\"}]}}, \"data_type\": \"CVE\", \"references\": {\"reference_data\": [{\"url\": \"https://github.com/erpscanteam/CVE-2018-2380\", \"name\": \"https://github.com/erpscanteam/CVE-2018-2380\", \"refsource\": \"MISC\"}, {\"url\": \"https://www.exploit-db.com/exploits/44292/\", \"name\": \"44292\", \"refsource\": \"EXPLOIT-DB\"}, {\"url\": \"https://launchpad.support.sap.com/#/notes/2547431\", \"name\": \"https://launchpad.support.sap.com/#/notes/2547431\", \"refsource\": \"CONFIRM\"}, {\"url\": \"http://www.securityfocus.com/bid/103001\", \"name\": \"103001\", \"refsource\": \"BID\"}, {\"url\": \"https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/\", \"name\": \"https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/\", \"refsource\": \"CONFIRM\"}]}, \"data_format\": \"MITRE\", \"description\": {\"description_data\": [{\"lang\": \"eng\", \"value\": \"SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing \\\"traverse to parent directory\\\" are passed through to the file APIs.\"}]}, \"problemtype\": {\"problemtype_data\": [{\"description\": [{\"lang\": \"eng\", \"value\": \"Directory/Path Traversal\"}]}]}, \"data_version\": \"4.0\", \"CVE_data_meta\": {\"ID\": \"CVE-2018-2380\", \"STATE\": \"PUBLIC\", \"ASSIGNER\": \"cna@sap.com\"}}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2018-2380\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-10-21T23:45:56.073Z\", \"dateReserved\": \"2017-12-15T00:00:00.000Z\", \"assignerOrgId\": \"e4686d1a-f260-4930-ac4c-2f5c992778dd\", \"datePublished\": \"2018-03-01T17:00:00.000Z\", \"assignerShortName\": \"sap\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2018-2380

Vulnerability from fkie_nvd - Published: 2018-03-01 17:29 - Updated: 2025-10-31 22:05

CISA KEV

Severity ?

6.6 (Medium) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
6.6 (Medium) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L

Summary

References

URL	Tags
cna@sap.com	http://www.securityfocus.com/bid/103001	Broken Link, Third Party Advisory, VDB Entry
cna@sap.com	https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/	Vendor Advisory
cna@sap.com	https://github.com/erpscanteam/CVE-2018-2380	Exploit, Third Party Advisory
cna@sap.com	https://launchpad.support.sap.com/#/notes/2547431	Permissions Required
cna@sap.com	https://www.exploit-db.com/exploits/44292/	Exploit, Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108	http://www.securityfocus.com/bid/103001	Broken Link, Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108	https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/erpscanteam/CVE-2018-2380	Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://launchpad.support.sap.com/#/notes/2547431	Permissions Required
af854a3a-2127-422b-91ae-364da2661108	https://www.exploit-db.com/exploits/44292/	Exploit, Third Party Advisory, VDB Entry
134c704f-9b21-4f2e-91b3-4a467353bcc0	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-2380	US Government Resource

Impacted products

Vendor	Product	Version
sap	customer_relationship_management	7.01
sap	customer_relationship_management	7.02
sap	customer_relationship_management	7.30
sap	customer_relationship_management	7.31
sap	customer_relationship_management	7.33
sap	customer_relationship_management	7.54

JSON

To clipboard

{
  "cisaActionDue": "2022-05-03",
  "cisaExploitAdd": "2021-11-03",
  "cisaRequiredAction": "Apply updates per vendor instructions.",
  "cisaVulnerabilityName": "SAP Customer Relationship Management (CRM) Path Traversal Vulnerability",
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sap:customer_relationship_management:7.01:*:*:*:*:*:*:*",
              "matchCriteriaId": "136E88EF-877A-4881-B098-3472E02FC45A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:customer_relationship_management:7.02:*:*:*:*:*:*:*",
              "matchCriteriaId": "3029F4DC-63CD-49C6-A98E-5A5B01E104FA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:customer_relationship_management:7.30:*:*:*:*:*:*:*",
              "matchCriteriaId": "51E097C6-61E3-4D8A-ABEC-A32BA68E3D87",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:customer_relationship_management:7.31:*:*:*:*:*:*:*",
              "matchCriteriaId": "4258AAE6-ABD0-47C1-B794-E68D3A57EEE0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:customer_relationship_management:7.33:*:*:*:*:*:*:*",
              "matchCriteriaId": "4392BD0F-A286-4AEA-89E5-D151034C9055",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:sap:customer_relationship_management:7.54:*:*:*:*:*:*:*",
              "matchCriteriaId": "CFD82446-BD1D-40E7-A216-2239B7D07691",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing \"traverse to parent directory\" are passed through to the file APIs."
    },
    {
      "lang": "es",
      "value": "SAP CRM 7.01, 7.02, 7.30, 7.31, 7.33 y 7.54 permite que un atacante explote la validaci\u00f3n insuficiente de la informaci\u00f3n de ruta proporcionada por los usuarios, por lo que los caracteres que representan \"salto al directorio padre\" se pasan a las API de archivo."
    }
  ],
  "id": "CVE-2018-2380",
  "lastModified": "2025-10-31T22:05:53.403",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 6.6,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "HIGH",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 3.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 6.6,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "HIGH",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 3.7,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  },
  "published": "2018-03-01T17:29:00.413",
  "references": [
    {
      "source": "cna@sap.com",
      "tags": [
        "Broken Link",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securityfocus.com/bid/103001"
    },
    {
      "source": "cna@sap.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/"
    },
    {
      "source": "cna@sap.com",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://github.com/erpscanteam/CVE-2018-2380"
    },
    {
      "source": "cna@sap.com",
      "tags": [
        "Permissions Required"
      ],
      "url": "https://launchpad.support.sap.com/#/notes/2547431"
    },
    {
      "source": "cna@sap.com",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "https://www.exploit-db.com/exploits/44292/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Broken Link",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securityfocus.com/bid/103001"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://github.com/erpscanteam/CVE-2018-2380"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Permissions Required"
      ],
      "url": "https://launchpad.support.sap.com/#/notes/2547431"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "https://www.exploit-db.com/exploits/44292/"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "US Government Resource"
      ],
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-2380"
    }
  ],
  "sourceIdentifier": "cna@sap.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}

GHSA-22J7-69M5-2PQH

Vulnerability from github – Published: 2022-05-14 03:35 – Updated: 2025-10-22 00:31

Details

Severity ?

6.6 (Medium)


                  
                    CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2018-2380"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-03-01T17:29:00Z",
    "severity": "MODERATE"
  },
  "details": "SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing \"traverse to parent directory\" are passed through to the file APIs.",
  "id": "GHSA-22j7-69m5-2pqh",
  "modified": "2025-10-22T00:31:29Z",
  "published": "2022-05-14T03:35:51Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-2380"
    },
    {
      "type": "WEB",
      "url": "https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018"
    },
    {
      "type": "WEB",
      "url": "https://github.com/erpscanteam/CVE-2018-2380"
    },
    {
      "type": "WEB",
      "url": "https://launchpad.support.sap.com/#/notes/2547431"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-2380"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/44292"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/103001"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

CNVD-2018-06284

Vulnerability from cnvd - Published: 2018-03-26

Title

SAP CRM路径遍历漏洞

Description

SAP CRM（Customer Relationship Management）是德国思爱普（SAP）公司的一套客户关系管理解决方案。该方案包括销售管理、营销管理、客户服务系统等模块。 SAP CRM中存在路径遍历漏洞，该漏洞源于程序未能充分的验证路径信息。攻击者可通过发送带有目录遍历序列的特制请求利用该漏洞在应用程序的上下文中检索任意文件。

Severity

中

Patch Name

SAP CRM路径遍历漏洞的补丁

Patch Description

Formal description

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/

Reference

https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/

Impacted products

Name
['SAP Customer Relationship Management (CRM) 7.01', 'SAP Customer Relationship Management (CRM) 7.02', 'SAP Customer Relationship Management (CRM) 7.30', 'SAP Customer Relationship Management (CRM) 7.31', 'SAP Customer Relationship Management (CRM) 7.33', 'SAP Customer Relationship Management (CRM) 7.54']

Show details on source website

JSON

To clipboard

{
  "bids": {
    "bid": {
      "bidNumber": "103001"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2018-2380",
      "cveUrl": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2380"
    }
  },
  "description": "SAP CRM\uff08Customer Relationship Management\uff09\u662f\u5fb7\u56fd\u601d\u7231\u666e\uff08SAP\uff09\u516c\u53f8\u7684\u4e00\u5957\u5ba2\u6237\u5173\u7cfb\u7ba1\u7406\u89e3\u51b3\u65b9\u6848\u3002\u8be5\u65b9\u6848\u5305\u62ec\u9500\u552e\u7ba1\u7406\u3001\u8425\u9500\u7ba1\u7406\u3001\u5ba2\u6237\u670d\u52a1\u7cfb\u7edf\u7b49\u6a21\u5757\u3002\r\n\r\nSAP CRM\u4e2d\u5b58\u5728\u8def\u5f84\u904d\u5386\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u672a\u80fd\u5145\u5206\u7684\u9a8c\u8bc1\u8def\u5f84\u4fe1\u606f\u3002\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u53d1\u9001\u5e26\u6709\u76ee\u5f55\u904d\u5386\u5e8f\u5217\u7684\u7279\u5236\u8bf7\u6c42\u5229\u7528\u8be5\u6f0f\u6d1e\u5728\u5e94\u7528\u7a0b\u5e8f\u7684\u4e0a\u4e0b\u6587\u4e2d\u68c0\u7d22\u4efb\u610f\u6587\u4ef6\u3002",
  "discovererName": "erp scan team",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2018-06284",
  "openTime": "2018-03-26",
  "patchDescription": "SAP CRM\uff08Customer Relationship Management\uff09\u662f\u5fb7\u56fd\u601d\u7231\u666e\uff08SAP\uff09\u516c\u53f8\u7684\u4e00\u5957\u5ba2\u6237\u5173\u7cfb\u7ba1\u7406\u89e3\u51b3\u65b9\u6848\u3002\u8be5\u65b9\u6848\u5305\u62ec\u9500\u552e\u7ba1\u7406\u3001\u8425\u9500\u7ba1\u7406\u3001\u5ba2\u6237\u670d\u52a1\u7cfb\u7edf\u7b49\u6a21\u5757\u3002\r\n\r\nSAP CRM\u4e2d\u5b58\u5728\u8def\u5f84\u904d\u5386\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u672a\u80fd\u5145\u5206\u7684\u9a8c\u8bc1\u8def\u5f84\u4fe1\u606f\u3002\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u53d1\u9001\u5e26\u6709\u76ee\u5f55\u904d\u5386\u5e8f\u5217\u7684\u7279\u5236\u8bf7\u6c42\u5229\u7528\u8be5\u6f0f\u6d1e\u5728\u5e94\u7528\u7a0b\u5e8f\u7684\u4e0a\u4e0b\u6587\u4e2d\u68c0\u7d22\u4efb\u610f\u6587\u4ef6\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "SAP CRM\u8def\u5f84\u904d\u5386\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "SAP Customer Relationship Management (CRM) 7.01",
      "SAP Customer Relationship Management (CRM) 7.02",
      "SAP Customer Relationship Management (CRM) 7.30",
      "SAP Customer Relationship Management (CRM) 7.31",
      "SAP Customer Relationship Management (CRM) 7.33",
      "SAP Customer Relationship Management (CRM) 7.54"
    ]
  },
  "referenceLink": "https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/",
  "serverity": "\u4e2d",
  "submitTime": "2018-03-15",
  "title": "SAP CRM\u8def\u5f84\u904d\u5386\u6f0f\u6d1e"
}

GSD-2018-2380

Vulnerability from gsd - Updated: 2023-12-13 01:22

Details

Aliases

CVE-2018-2380

Aliases

CVE-2018-2380

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2018-2380",
    "description": "SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing \"traverse to parent directory\" are passed through to the file APIs.",
    "id": "GSD-2018-2380",
    "references": [
      "https://packetstormsecurity.com/files/cve/CVE-2018-2380"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2018-2380"
      ],
      "details": "SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing \"traverse to parent directory\" are passed through to the file APIs.",
      "id": "GSD-2018-2380",
      "modified": "2023-12-13T01:22:31.675172Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cisa.gov": {
      "cveID": "CVE-2018-2380",
      "dateAdded": "2021-11-03",
      "dueDate": "2022-05-03",
      "product": "SAP CRM",
      "requiredAction": "Apply updates per vendor instructions.",
      "shortDescription": "SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing \"traverse to parent directory\" are passed through to the file APIs.",
      "vendorProject": "SAP",
      "vulnerabilityName": "SAP NetWeaver AS JAVA CRM Remote Code Execution Vulnerability"
    },
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cna@sap.com",
        "ID": "CVE-2018-2380",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "SAP CRM",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "=",
                          "version_value": "7.01"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "7.02"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "7.30"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "7.31"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "7.33"
                        },
                        {
                          "version_affected": "=",
                          "version_value": "7.54"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "SAP SE"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing \"traverse to parent directory\" are passed through to the file APIs."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "Directory/Path Traversal"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://github.com/erpscanteam/CVE-2018-2380",
            "refsource": "MISC",
            "url": "https://github.com/erpscanteam/CVE-2018-2380"
          },
          {
            "name": "44292",
            "refsource": "EXPLOIT-DB",
            "url": "https://www.exploit-db.com/exploits/44292/"
          },
          {
            "name": "https://launchpad.support.sap.com/#/notes/2547431",
            "refsource": "CONFIRM",
            "url": "https://launchpad.support.sap.com/#/notes/2547431"
          },
          {
            "name": "103001",
            "refsource": "BID",
            "url": "http://www.securityfocus.com/bid/103001"
          },
          {
            "name": "https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/",
            "refsource": "CONFIRM",
            "url": "https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:sap:customer_relationship_management:7.33:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:sap:customer_relationship_management:7.01:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:sap:customer_relationship_management:7.02:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:sap:customer_relationship_management:7.30:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:sap:customer_relationship_management:7.31:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:sap:customer_relationship_management:7.54:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "cna@sap.com",
          "ID": "CVE-2018-2380"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing \"traverse to parent directory\" are passed through to the file APIs."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-22"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://launchpad.support.sap.com/#/notes/2547431",
              "refsource": "CONFIRM",
              "tags": [
                "Permissions Required"
              ],
              "url": "https://launchpad.support.sap.com/#/notes/2547431"
            },
            {
              "name": "https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/",
              "refsource": "CONFIRM",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/"
            },
            {
              "name": "103001",
              "refsource": "BID",
              "tags": [
                "Third Party Advisory",
                "VDB Entry"
              ],
              "url": "http://www.securityfocus.com/bid/103001"
            },
            {
              "name": "https://github.com/erpscanteam/CVE-2018-2380",
              "refsource": "MISC",
              "tags": [
                "Exploit",
                "Third Party Advisory"
              ],
              "url": "https://github.com/erpscanteam/CVE-2018-2380"
            },
            {
              "name": "44292",
              "refsource": "EXPLOIT-DB",
              "tags": [
                "Exploit",
                "Third Party Advisory",
                "VDB Entry"
              ],
              "url": "https://www.exploit-db.com/exploits/44292/"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
            "version": "2.0"
          },
          "exploitabilityScore": 8.0,
          "impactScore": 6.4,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": false
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L",
            "version": "3.0"
          },
          "exploitabilityScore": 2.3,
          "impactScore": 3.7
        }
      },
      "lastModifiedDate": "2018-03-23T16:39Z",
      "publishedDate": "2018-03-01T17:29Z"
    }
  }
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2018-2380 (GCVE-0-2018-2380)

CISA KEV

Known Exploited Vulnerability - GCVE BCP-07 Compliant

Timestamps

Scope

Evidence

Vendor Report Successful Exploitation Confidence: 80% Source: cisa-kev

Details

References

FKIE_CVE-2018-2380

GHSA-22J7-69M5-2PQH

CNVD-2018-06284

GSD-2018-2380

Tags

Sightings

Nomenclature