# CVE-2018-2380

SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing "traverse to parent directory" are passed through to the file APIs.

- Page: https://www.vulneraibility.com/cve/CVE-2018-2380
- CVSS: 6.6
- Known exploited: yes, in CISA KEV since 2021-11-03; CISA due date 2022-05-03; known ransomware use
- EPSS: 28.93% (percentile 98.2)
- Public exploit code: 1 on Exploit-DB · 1 GitHub proof of concept (first 2018-03-14)
- CISA SSVC: exploitation active, automatable no, technical impact partial (assessed 2025-01-29)
- Weakness: CWE-22
- Published: 2018-03-01

## Affected versions

- SAP SE SAP CRM: affected 7.01; 7.02; 7.30; 7.31; 7.33; 7.54

A version outside these ranges is not a statement that it is unaffected.

## References

- [other] https://github.com/erpscanteam/CVE-2018-2380
- [exploit] https://www.exploit-db.com/exploits/44292/
- [other] https://launchpad.support.sap.com/#/notes/2547431
- [other] http://www.securityfocus.com/bid/103001
- [other] https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-2380

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.