CVE-2018-2380
Medium 6.6 Exploited in the wild (KEV) Used in ransomware campaigns
Confirmed active exploitation — CISA KEV catalog
- Name
- SAP Customer Relationship Management (CRM) Path Traversal Vulnerability
- Added to catalog
- Remediation due date (US federal)
- Required action
- Apply updates per vendor instructions.
Description
SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing "traverse to parent directory" are passed through to the file APIs.
Metrics
- CVSS 3.1
-
6.6 (MEDIUM)
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L - EPSS — exploit probability
- 29% (percentile: 98) as of 1 November 2026
- CWE
- CWE-22
Affected products
sap: customer relationship management
References
- https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/ Vendor Advisory
- https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/ Vendor Advisory
- https://github.com/erpscanteam/CVE-2018-2380 ExploitThird Party Advisory
- https://www.exploit-db.com/exploits/44292/ ExploitThird Party AdvisoryVDB Entry
- https://github.com/erpscanteam/CVE-2018-2380 ExploitThird Party Advisory
- https://www.exploit-db.com/exploits/44292/ ExploitThird Party AdvisoryVDB Entry
- http://www.securityfocus.com/bid/103001 Broken LinkThird Party AdvisoryVDB Entry
- https://launchpad.support.sap.com/#/notes/2547431 Permissions Required
- http://www.securityfocus.com/bid/103001 Broken LinkThird Party AdvisoryVDB Entry
- https://launchpad.support.sap.com/#/notes/2547431 Permissions Required