CVE-2018-2367

HIGH

SAP BASIS 7.00-7.02, 7.10-7.11, 7.30, 7.31, 7.40, 7.50-7.52 - Path Traversal in ABAP File Interface

Title source: llm

Description

ABAP File Interface in, SAP BASIS, from 7.00 to 7.02, from 7.10 to 7.11, 7.30, 7.31, 7.40, from 7.50 to 7.52, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing "traverse to parent directory" are passed through to the file APIs.

References (3)

Core 3

Core References

Vendor Advisory x_refsource_confirm

https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/103006

Permissions Required x_refsource_confirm

https://launchpad.support.sap.com/#/notes/2562089

Scores

CVSS v3 8.8

EPSS 0.0181

EPSS Percentile 83.1%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-22

Status published

Products (4)

sap/business_application_software_integrated_solution 7.30

sap/business_application_software_integrated_solution 7.31

sap/business_application_software_integrated_solution 7.40

sap/business_application_software_integrated_solution 7.00 - 7.02

Published Mar 01, 2018

Tracked Since Feb 18, 2026