CVE-2018-2380

Summary

SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing "traverse to parent directory" are passed through to the file APIs.

Affected Software

Weaknesses

• Directory/Path Traversal

ADP Enrichment

CVE Program Container

Additional References

• https://github.com/erpscanteam/CVE-2018-2380
• https://www.exploit-db.com/exploits/44292/
• https://launchpad.support.sap.com/#/notes/2547431
• http://www.securityfocus.com/bid/103001
• https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/

CISA ADP Vulnrichment

• SSVC:
• Exploitation: active
  • Automatable: no
  • Technical Impact: partial

Additional References

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-2380

References

• https://github.com/erpscanteam/CVE-2018-2380
• https://www.exploit-db.com/exploits/44292/
• https://launchpad.support.sap.com/#/notes/2547431
• http://www.securityfocus.com/bid/103001
• https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/

• ←Previous
• Next→