Actively exploited · Published Mar 1, 2018 · Assigned by sap
CVE-2018-2380
Medium 6.6 Exploited Ransomware
In plain English
A medium-severity path traversal in SAP CRM from SAP SE. Attackers are actively exploiting it in the wild (listed by CISA on November 3, 2021). It has been used in ransomware campaigns. The chance it is exploited in the next 30 days is estimated at 28.9% (higher than 98% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Apply updates per vendor instructions.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by May 3, 2022.
Official description
SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing "traverse to parent directory" are passed through to the file APIs.
Affected products (as reported)
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
References
- https://github.com/erpscanteam/CVE-2018-2380 x_refsource_MISC
- 44292 exploit, x_refsource_EXPLOIT-DB
- https://launchpad.support.sap.com/#/notes/2547431 x_refsource_CONFIRM
- 103001 vdb-entry, x_refsource_BID
- https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/ x_refsource_CONFIRM
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-2380 government-resource