PT-2018-3768 · Sap · Sap Crm

Publicado 2018-03-01 · Atualizado 2025-10-31 · CVE-2018-2380

Positive Technologies (AI Summary)

CVSS v3.1

6.6

Média

Vetor base

AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions SAP CRM versions 7.01 through 7.54

Description The issue is related to insufficient validation of path information provided by users, allowing an attacker to exploit this weakness. This can lead to characters representing "traverse to parent directory" being passed through to the file APIs, potentially enabling remote attackers to execute arbitrary commands due to incorrect restriction of access to a limited directory.

Recommendations For versions 7.01 through 7.54, update to a version that includes the necessary security patches to address the path traversal vulnerability. As a temporary workaround, consider restricting access to sensitive directories and limiting the ability to traverse to parent directories until a patch is available.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

BDU:2021-05860

CVE-2018-2380

Produtos afetados

Sap Crm

Referências · 13

• 🔥 https://github.com/erpscanteam/CVE-2018-2380 · Exploit
• 🔥 https://exploit-db.com/exploits/44292 · Exploit
• https://bdu.fstec.ru/vul/2021-05860 · Nota de Segurança
• https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018 · Aviso do Fabricante
• https://t.me/cvenotify/109077 · Publicação no Telegram
• https://launchpad.support.sap.com/#/notes/2547431 · Nota
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-2380 · Nota
• https://osv.dev/vulnerability/CVE-2018-2380 · Aviso do Fabricante
• https://t.me/cvenotify/108865 · Publicação no Telegram
• https://t.me/cveNotify/141203 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2018-2380 · Nota de Segurança
• http://securityfocus.com/bid/103001 · Nota
• https://t.me/cvenotify/114525 · Publicação no Telegram