{"id":"CVE-2018-2380","aliases":["EUVD-2018-14235","GHSA-22j7-69m5-2pqh"],"status":"published","title":"SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation...","description":"SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing \"traverse to parent directory\" are passed through to the file APIs.","severity":{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.28934,"percentile":0.98168,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":false},"cwes":["CWE-22"],"published":"2018-03-01T17:00:00Z","modified":"2026-06-17T01:55:36Z","kev":{"date_added":"2021-11-03","due_date":"2022-05-03","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Known"},"exploitation":[{"source":"euvd","since":"2021-11-03"},{"source":"kev","since":"2021-11-03"}],"exploits":[{"source":"exploitdb","id":"EDB-44292","title":"SAP NetWeaver AS JAVA CRM - Log injection Remote Command Execution","type":"remote","platform":"windows","date":"2018-03-14","url":"https://www.exploit-db.com/exploits/44292"},{"source":"pocgithub","id":"erpscanteam/CVE-2018-2380","title":"erpscanteam/CVE-2018-2380","date":"2018-03-14","url":"https://github.com/erpscanteam/CVE-2018-2380"}],"products":[{"vendor":"sap","product":"customer relationship management (crm)"},{"vendor":"sap","product":"customer_relationship_management"},{"vendor":"sap se","product":"sap crm"}],"references":[{"url":"https://github.com/erpscanteam/CVE-2018-2380","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://www.exploit-db.com/exploits/44292/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://launchpad.support.sap.com/#/notes/2547431","tags":["x_refsource_CONFIRM","x_transferred","Permissions Required"]},{"url":"http://www.securityfocus.com/bid/103001","tags":["vdb-entry","x_refsource_BID","x_transferred","Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-2380","tags":["government-resource","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-2380"},{"url":"https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018"},{"url":"https://www.exploit-db.com/exploits/44292"},{"url":"https://github.com/advisories/GHSA-22j7-69m5-2pqh"}],"sources":{"cve":[{"id":"CVE-2018-2380","description":"SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing \"traverse to parent directory\" are passed through to the file APIs.","status":"published","published":"2018-03-01T17:00:00Z","modified":"2025-10-21T23:45:56.073Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L","level":"medium","assessor":"adp"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:35:04.911021Z"}],"euvd":[{"id":"EUVD-2018-14235","description":"SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing \"traverse to parent directory\" are passed through to the file APIs.","status":"published","published":"2018-03-01T17:00:00Z","modified":"2025-10-21T23:45:56Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L","level":"medium"}],"exploited_since":"2021-11-03","updated_at":"2026-11-02T20:31:23.427989Z"}],"ghsa":[{"id":"GHSA-22j7-69m5-2pqh","title":"SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation...","description":"SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing \"traverse to parent directory\" are passed through to the file APIs.","status":"published","published":"2022-05-14T03:35:51Z","modified":"2025-10-22T00:31:30Z","cvss":[{"version":"3.0","score":6.6,"vector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:04:04.176931Z"}],"kev":[{"id":"CVE-2018-2380","title":"SAP Customer Relationship Management (CRM) Path Traversal Vulnerability","description":"SAP Customer Relationship Management (CRM) contains a path traversal vulnerability that allows an attacker to exploit insufficient validation of path information provided by users.","cwes":["CWE-22"],"kev":{"date_added":"2021-11-03","due_date":"2022-05-03","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Known"},"updated_at":"2026-11-02T17:00:17.050017Z"}],"nvd":[{"id":"CVE-2018-2380","description":"SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing \"traverse to parent directory\" are passed through to the file APIs.","status":"published","published":"2018-03-01T17:29:00.413Z","modified":"2026-06-17T01:55:36.227Z","cvss":[{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L","level":"medium","assessor":"primary"},{"version":"3.1","score":6.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:04:23.783914Z"}]}}