Actively exploited in the wild
SAP Customer Relationship Management (CRM) Path Traversal Vulnerability
SAP - Customer Relationship Management (CRM) · Listed in the CISA KEV since 2021-11-03. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2018-2380
MediumCVSS 6.6KEVSummary
SAP CRM, 7.01, 7.02, 7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing 'traverse to parent directory' are passed through to the file APIs.
Risk Assessment
An attacker could access files outside the intended directory, potentially leading to disclosure of sensitive data.
Recommendation
Apply SAP security updates for SAP CRM.
Other vulnerabilities in SAP CRM
Original NVD description (English source)
SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing "traverse to parent directory" are passed through to the file APIs.