{"id":"CVE-2018-2380","url":"https://www.cyber-defence.io/tools/cve/CVE-2018-2380","generatedAt":"2026-10-29T00:47:20.996Z","title":"SAP Customer Relationship Management (CRM) Path Traversal Vulnerability","description":"SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing \"traverse to parent directory\" are passed through to the file APIs.","published":"2018-03-01T17:29:00.000Z","lastModified":"2026-06-17T01:55:36.000Z","status":"Analyzed","sourceIdentifier":"cna@sap.com","cvss":{"version":"3.1","score":6.6,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L"},"cwe":["CWE-22"],"affected":["sap/customer relationship management"],"epss":{"score":0.28934,"percentile":0.98145,"date":"2026-10-27","history":[]},"kev":{"listed":true,"dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Known","notes":"Apply updates per vendor instructions.\nhttps://nvd.nist.gov/vuln/detail/CVE-2018-2380"},"exploits":{"count":1,"verified":false,"firstPublished":"2018-03-14","source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[{"edbId":44292,"kind":"exploit","title":"SAP NetWeaver AS JAVA CRM - Log injection Remote Command Execution","url":"https://www.exploit-db.com/exploits/44292","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/windows/remote/44292.py","file":"exploits/windows/remote/44292.py","published":"2018-03-14","added":"2018-03-16","updated":"2018-03-16","author":"erp scan team","type":"remote","platform":"windows","port":null,"verified":false,"codes":["CVE-2018-2380"],"tags":null,"aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":"https://github.com/erpscanteam/CVE-2018-2380/tree/ef45ad496a5da36b17e59194ba061b54cccac0b0"}]},"verdict":{"level":"urgent","text":"Known to be exploited in the wild (CISA KEV, CISA remediation deadline 3 May 2022). Treat as an emergency change: patch or isolate now, then hunt for prior compromise."},"changes":[],"references":[{"url":"http://www.securityfocus.com/bid/103001","tags":["Broken Link","Third Party Advisory","VDB Entry"],"source":"cna@sap.com"},{"url":"https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/","tags":["Vendor Advisory"],"source":"cna@sap.com"},{"url":"https://github.com/erpscanteam/CVE-2018-2380","tags":["Exploit","Third Party Advisory"],"source":"cna@sap.com"},{"url":"https://launchpad.support.sap.com/#/notes/2547431","tags":["Permissions Required"],"source":"cna@sap.com"},{"url":"https://www.exploit-db.com/exploits/44292/","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"cna@sap.com"},{"url":"http://www.securityfocus.com/bid/103001","tags":["Broken Link","Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/erpscanteam/CVE-2018-2380","tags":["Exploit","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://launchpad.support.sap.com/#/notes/2547431","tags":["Permissions Required"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.exploit-db.com/exploits/44292/","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-2380","tags":["US Government Resource"],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2018-2380","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}