ZeroDay Findings
Sign inSign up

Findings

CVE-2018-2380

SAP Customer Relationship Management (CRM) Path Traversal Vulnerability

Published Mar 1, 2018 · updated Jun 16, 2026 · sap customer relationship management

SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing "traverse to parent directory" are passed through to the file APIs.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 1, 2018 · Catalog

    Detected

    SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing "traverse to parent directory" are passed through to the file APIs.

  2. Nov 3, 2021 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. May 3, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing "traverse to parent directory" are passed through to the file APIs.

Required action

Apply updates per vendor instructions.

CISA due date May 3, 2022

Affected

  • cpe sap/customer relationship management7.01
  • cpe sap/customer relationship management7.02
  • cpe sap/customer relationship management7.30
  • cpe sap/customer relationship management7.31
  • cpe sap/customer relationship management7.33
  • cpe sap/customer relationship management7.54
  • vendor SAP Customer Relationship Management (CRM)version unspecified

Sources

  • CISA KEVCVE-2018-2380

    SAP Customer Relationship Management (CRM) contains a path traversal vulnerability that allows an attacker to exploit insufficient validation of path information provided by users.

    cisa.gov
  • CVE.orgCVE-2018-2380

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2018-2380

    30-day exploitation probability 28.9%

    first.org
  • Exploit Database44292

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • NIST NVDCVE-2018-2380

    SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing "traverse to parent directory" are passed through to the file APIs.

    nvd.nist.gov

References