CVE-2018-2380

· MEDIUMAnalyzed

← All CVEs

CVSS v3.1

6.6

EPSS

28.89%

Published

Mar 1, 2018

Modified

Oct 31, 2025

CISA Known Exploited Vulnerability

Added: 2021-11-03 · Due: 2022-05-03

Apply updates per vendor instructions.

Public PoC / Exploit (3)

All weaponized →

Exploit-DBSAP NetWeaver AS JAVA CRM - Log injection Remote Command Execution TrickestTrickest PoC index GitHub PoCerpscanteam/CVE-2018-2380★51

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing "traverse to parent directory" are passed through to the file APIs.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L

Weaknesses (CWE)

CWE-22CWE-22

Affected Products (6)

sap · customer_relationship_managementvulnerable

References (11)

http://www.securityfocus.com/bid/103001

Broken LinkThird Party AdvisoryVDB Entry

https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/

Vendor Advisory

https://github.com/erpscanteam/CVE-2018-2380

ExploitThird Party Advisory

https://launchpad.support.sap.com/#/notes/2547431

Permissions Required

https://www.exploit-db.com/exploits/44292/

ExploitThird Party AdvisoryVDB Entry