CVE-2018-2380

MEDIUM KEV RANSOMWARE

SAP Customer Relationship Management - Path Traversal

Title source: rule

Description

SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing "traverse to parent directory" are passed through to the file APIs.

Exploits (3)

exploitdb WORKING POC

by erp scan team · pythonremotewindows

https://www.exploit-db.com/exploits/44292

View Code ZIP pw:eip

nomisec WORKING POC 51 stars

by erpscanteam · remote

https://github.com/erpscanteam/CVE-2018-2380

View Code ZIP pw:eip

gitlab WORKING POC

by The-Real-TechLord · remote-auth

https://gitlab.com/The-Real-TechLord/CVE-2018-2380

View Code ZIP pw:eip

References (6)

[Broken Link, Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/103001

[Vendor Advisory] https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/

[Exploit, Third Party Advisory] https://github.com/erpscanteam/CVE-2018-2380

[Permissions Required] https://launchpad.support.sap.com/#/notes/2547431

[Exploit, Third Party Advisory, VDB Entry] https://www.exploit-db.com/exploits/44292/

[US Government Resource] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-2380

Scores

CVSS v3 6.6

EPSS 0.4879

EPSS Percentile 97.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L

Details

CISA KEV 2021-11-03

VulnCheck KEV 2021-04-08

InTheWild.io 2021-07-23

ENISA EUVD EUVD-2018-14235

Ransomware Use Confirmed

CWE

CWE-22

Status published

Products (6)

sap/customer_relationship_management 7.01

sap/customer_relationship_management 7.02

sap/customer_relationship_management 7.30

sap/customer_relationship_management 7.31

sap/customer_relationship_management 7.33

sap/customer_relationship_management 7.54

Published Mar 01, 2018

KEV Added Nov 03, 2021

Tracked Since Feb 18, 2026