Vulnerability record · CVE-2018-2380 · published 1 March 2018
CVE-2018-2380: SAP CRM path traversal in user-supplied path validation
Sap · Customer Relationship Management
SAP CRM versions 7.01, 7.02, 7.30, 7.31, 7.33 and 7.54 fail to properly validate user-supplied path information, allowing parent-directory traversal characters to reach file APIs. This lets an authenticated attacker read or write files outside the intended directory on the CRM server.
Description
SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing "traverse to parent directory" are passed through to the file APIs.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
Automated analysis
high priorityThe flaw is in CISA KEV with known ransomware use and public exploits, though exploitation requires high privileges and impact is limited to low confidentiality, integrity and availability.
What it is
SAP CRM versions 7.01, 7.02, 7.30, 7.31, 7.33 and 7.54 fail to properly validate user-supplied path information, allowing parent-directory traversal characters to reach file APIs. This lets an authenticated attacker read or write files outside the intended directory on the CRM server.
Impact
An attacker with access to the affected CRM functionality can traverse directories to access or manipulate files on the server, potentially exposing sensitive data or altering application files.
Attack surface
Reachable over the network through the CRM application's file-handling functionality; the CVSS vector indicates high privileges are required and no user interaction is needed.
Exploitation
Listed in CISA KEV since 2021-11-03 with known ransomware campaign use, and public exploit code exists (Exploit-DB 44292, GitHub erpscanteam/CVE-2018-2380); EPSS 30-day probability is about 0.29 (98th percentile).
What to do
- Apply the SAP security patch referenced in SAP Security Patch Day February 2018 and SAP note 2547431.
- Restrict network access to the CRM application and its file-handling endpoints to trusted users and networks.
- Enforce least privilege on CRM accounts to limit which users can reach the vulnerable functionality.
- Monitor and restrict file system permissions for the CRM service account to reduce traversal impact.
Detection
- Review CRM and web server logs for path parameters containing '../' or encoded traversal sequences.
- Alert on file access outside expected CRM directories by the CRM service account.
- Hunt for requests matching known public exploit patterns for CVE-2018-2380.
- Correlate unusual file reads or writes with CRM user sessions.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2018-2380 to the Known Exploited Vulnerabilities catalog on 3 November 2021 as "SAP Customer Relationship Management (CRM) Path Traversal Vulnerability". CISA reports known use in ransomware campaigns. Required action: Apply updates per vendor instructions. Federal deadline 3 May 2022.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| http://www.securityfocus.com/bid/103001 | Broken LinkThird Party AdvisoryVDB Entry |
| https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/ | Vendor Advisory |
| https://github.com/erpscanteam/CVE-2018-2380 | ExploitThird Party Advisory |
| https://launchpad.support.sap.com/#/notes/2547431 | Permissions Required |
| https://www.exploit-db.com/exploits/44292/ | ExploitThird Party AdvisoryVDB Entry |
| http://www.securityfocus.com/bid/103001 | Broken LinkThird Party AdvisoryVDB Entry |
| https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/ | Vendor Advisory |
| https://github.com/erpscanteam/CVE-2018-2380 | ExploitThird Party Advisory |
| https://launchpad.support.sap.com/#/notes/2547431 | Permissions Required |
| https://www.exploit-db.com/exploits/44292/ | ExploitThird Party AdvisoryVDB Entry |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-2380 | US Government Resource |
Track CVE-2018-2380 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2018-2380), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
