CVE-2018-2380

Katalog CVE

CVSS 6.6 · Medium KEV · sudah dieksploitasi Dipakai ransomware EPSS 28,9%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada sap customer relationship management. Skor CVSS 3.1 6.6 (Medium) menurut NVD. Masuk katalog KEV CISA pada 3 November 2021, artinya sudah terbukti dieksploitasi. Tercatat dipakai dalam kampanye ransomware.

Deskripsi (NVD)

SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing "traverse to parent directory" are passed through to the file APIs.

Rincian

Terbit di NVD

1 Maret 2018

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.6 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

28,9% peluang dieksploitasi; lebih tinggi dari 98,1% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

SAP Customer Relationship Management (CRM) Path Traversal Vulnerability

Masuk KEV

3 November 2021

Tenggat CISA

3 Mei 2022 (untuk instansi federal AS)

Ransomware

Tercatat dipakai dalam kampanye ransomware

Tindakan wajib

Apply updates per vendor instructions.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/ advisory vendor
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-2380 pemerintah AS
• http://www.securityfocus.com/bid/103001 broken link · advisory pihak ketiga · vdb entry
• https://github.com/erpscanteam/CVE-2018-2380 exploit · advisory pihak ketiga
• https://www.exploit-db.com/exploits/44292/ exploit · advisory pihak ketiga · vdb entry
• https://launchpad.support.sap.com/#/notes/2547431 permissions required