CVE-2018-2380

Known Exploited Vulnerability

SAP Customer Relationship Management (CRM) Path Traversal Vulnerability

Vendor / product: SAP / Customer Relationship Management (CRM)

Description

SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing "traverse to parent directory" are passed through to the file APIs.

Weakness classification

• CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Primary references

• cna@sap.com — Broken Link, Third Party Advisory, VDB Entry
• cna@sap.com — Vendor Advisory
• cna@sap.com — Exploit, Third Party Advisory
• cna@sap.com — Permissions Required
• cna@sap.com — Exploit, Third Party Advisory, VDB Entry
• af854a3a-2127-422b-91ae-364da2661108 — Broken Link, Third Party Advisory, VDB Entry
• af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Permissions Required
• af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory, VDB Entry
• 134c704f-9b21-4f2e-91b3-4a467353bcc0 — US Government Resource