CVE-2018-2380

SAP Customer Relationship Management (CRM) Path Traversal Vulnerability

Customer Relationship Management

SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing "traverse to parent directory" are passed through to the file APIs.

1. Mär 2018

Ausgewertete Quellen

• Hersteller
  https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/
• Hinweis
  http://www.securityfocus.com/bid/103001
• Hinweis
  https://www.exploit-db.com/exploits/44292/
• CISA
  https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-2380
• CISA
  SAP Customer Relationship Management (CRM) Path Traversal Vulnerability
• NVD
  CVE-2018-2380
• GitHub
  https://github.com/erpscanteam/CVE-2018-2380