PT-2018-15537 · Sap · Crystal Reports Server

Published 2018-04-10 · Updated 2019-10-09 · CVE-2018-2406

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Crystal Reports Server, OEM Edition (CRSE) versions 4.0 through 4.30

Description The issue concerns an unquoted windows search path, also known as a directory/path traversal vulnerability, in the startup path of the affected software.

Recommendations For Crystal Reports Server, OEM Edition (CRSE) versions 4.0 through 4.30, update the startup path to properly quote the directory to prevent path traversal attacks.

Fix

Weakness Enumeration

CWE-428

Related Identifiers

CVE-2018-2406

Affected Products

Crystal Reports Server

References · 5

• https://osv.dev/vulnerability/CVE-2018-2406 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-2406 · Security Note
• https://blogs.sap.com/2018/04/10/sap-security-patch-day-april-2018 · Vendor Advisory
• http://securityfocus.com/bid/103719 · Note
• https://launchpad.support.sap.com/#/notes/2560132 · Note