PT-2018-3768 · Sap · Sap Crm

Published 2018-03-01 · Updated 2025-10-31 · CVE-2018-2380

Positive Technologies (AI Summary)

CVSS v3.1

6.6

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions SAP CRM versions 7.01 through 7.54

Description The issue is related to insufficient validation of path information provided by users, allowing an attacker to exploit this weakness. This can lead to characters representing "traverse to parent directory" being passed through to the file APIs, potentially enabling remote attackers to execute arbitrary commands due to incorrect restriction of access to a limited directory.

Recommendations For versions 7.01 through 7.54, update to a version that includes the necessary security patches to address the path traversal vulnerability. As a temporary workaround, consider restricting access to sensitive directories and limiting the ability to traverse to parent directories until a patch is available.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2021-05860

CVE-2018-2380

Affected Products

Sap Crm

References · 13

• 🔥 https://github.com/erpscanteam/CVE-2018-2380 · Exploit
• 🔥 https://exploit-db.com/exploits/44292 · Exploit
• https://bdu.fstec.ru/vul/2021-05860 · Security Note
• https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-2380 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-2380 · Security Note
• https://t.me/cvenotify/109077 · Telegram Post
• https://launchpad.support.sap.com/#/notes/2547431 · Note
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-2380 · Note
• https://t.me/cvenotify/108865 · Telegram Post
• https://t.me/cveNotify/141203 · Telegram Post
• http://securityfocus.com/bid/103001 · Note
• https://t.me/cvenotify/114525 · Telegram Post