Sap Customer Relationship Management vulnerabilities
10 vulnerabilities
Known vulnerabilities in Sap Customer Relationship Management, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2018-2380sap sesap crm+1KEVRansomware
EPSS score28.93%
SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing "traverse to parent directory" are passed through to the file APIs.CVE-2013-7095sapcustomer_relationship_managementEPSS score2.06%
The XML parser (crm_flex_data) in SAP Customer Relationship Management (CRM) 7.02 EHP 2 has unknown impact and attack vectors related to an XML External Entity (XXE) issue.CVE-2021-33676sap sesap crm+1EPSS score0.91%
A missing authority check in SAP CRM, versions - 700, 701, 702, 712, 713, 714, could be leveraged by an attacker with high privileges to compromise confidentiality, integrity, or availability of the system.CVE-2015-3979sapcustomer_relationship_managementEPSS score2.45%
Unspecified vulnerability in the Business Rules Framework (CRM-BF-BRF) in SAP CRM allows attackers to execute arbitrary code via unknown vectors, aka SAP Security Note 2097534.CVE-2015-3980sapcustomer_relationship_managementEPSS score1.44%
SQL injection vulnerability in the Business Rules Framework (CRM-BF-BRF) in SAP CRM allows attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2097534.CVE-2014-1962sapcustomer_relationship_managementEPSS score1.47%
Gwsync in SAP CRM 7.02 EHP 2 allows remote attackers to obtain sensitive information via unspecified vectors, related to an XML External Entity (XXE) issue.CVE-2014-8669sapcustomer_relationship_managementEPSS score5.48%
The SAP Promotion Guidelines (CRM-MKT-MPL-TPM-PPG) module for SAP CRM allows remote attackers to execute arbitrary code via unspecified vectors.CVE-2017-15296sapcustomer_relationship_managementEPSS score0.55%
The Java component in SAP CRM has CSRF. This is SAP Security Note 2478964.CVE-2017-15294sapcustomer_relationship_managementEPSS score0.98%
The Java administration console in SAP CRM has XSS. This is SAP Security Note 2478964.CVE-2023-27897sapcrm+1EPSS score0.65%
In SAP CRM - versions 700, 701, 702, 712, 713, an attacker who is authenticated with a non-administrative role and a common remote execution authorization can use a vulnerable interface to execute an application function to perform actions which they would not normally be permitted to perform. Depending on the function executed, the attack can can have limited impact on confidentiality and integrity of non-critical user or application data and application availability.