{"schemaVersion":3,"id":"CVE-2018-2380","aliases":[],"status":"published","duplicateOf":null,"title":"SAP Customer Relationship Management (CRM) Path Traversal Vulnerability","description":"SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing \"traverse to parent directory\" are passed through to the file APIs.","dates":{"published":"2018-03-01T17:00:00.000Z","modified":"2025-10-21T23:45:56.073Z","reserved":null,"kevAdded":["2021-11-03T00:00:00.000Z"],"kevDue":["2022-05-03T00:00:00.000Z"]},"cvss":{"headline":{"score":6.6,"severity":"medium","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":6.6,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":6.6,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":6.5,"severity":"medium","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.28934,"percentile":0.98153,"severity":"high","asOf":"2026-10-21T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-21T00:00:00.000Z","baselineScore":0.28934},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.28934,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.28934,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.28934,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.28934,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.28934,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.28934,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.28934,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.28934,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.28934,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.28934,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.28934,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.28934,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.28934,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.28934,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.28934,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.28934,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.28934,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.28934,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.28934,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.28934,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.28934,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.28934,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.28934,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.28934,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.28934,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.28934,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.28934,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.28934,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.28934,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.28934,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.28934,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.28934,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.28934,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.28934,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.28934,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.28934,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.28934,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.28934,"percentile":0.98153}],"last30":[{"date":"2026-09-21T00:00:00.000Z","score":0.28934,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.28934,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.28934,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.28934,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.28934,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.28934,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.28934,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.28934,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.28934,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.28934,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.28934,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.28934,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.28934,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.28934,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.28934,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.28934,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.28934,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.28934,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.28934,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.28934,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.28934,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.28934,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.28934,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.28934,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.28934,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.28934,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.28934,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.28934,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.28934,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.28934,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.28934,"percentile":0.98153}]},"kev":{"state":"listed","entries":[{"source":"cisa","sourceLabel":"CISA","dateAdded":"2021-11-03T00:00:00.000Z","dueDate":"2022-05-03T00:00:00.000Z","requiredAction":"Apply updates per vendor instructions.","name":"SAP Customer Relationship Management (CRM) Path Traversal Vulnerability","description":"SAP Customer Relationship Management (CRM) contains a path traversal vulnerability that allows an attacker to exploit insufficient validation of path information provided by users.","notes":[{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2018-2380","label":"nvd.nist.gov/vuln/detail/CVE-2018-2380"}],"vendor":"SAP","product":"Customer Relationship Management (CRM)","ransomware":true,"ransomwareUse":"Known","exploitationType":null}],"listedCount":1,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":true,"entry":{"source":"cisa","sourceLabel":"CISA","dateAdded":"2021-11-03T00:00:00.000Z","dueDate":"2022-05-03T00:00:00.000Z","requiredAction":"Apply updates per vendor instructions.","name":"SAP Customer Relationship Management (CRM) Path Traversal Vulnerability","description":"SAP Customer Relationship Management (CRM) contains a path traversal vulnerability that allows an attacker to exploit insufficient validation of path information provided by users.","notes":[{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2018-2380","label":"nvd.nist.gov/vuln/detail/CVE-2018-2380"}],"vendor":"SAP","product":"Customer Relationship Management (CRM)","ransomware":true,"ransomwareUse":"Known","exploitationType":null}},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"known","sources":["cisa"]},"exploits":[{"id":"GITHUB_ERPSCANTEAM_CVE-2018-2380","name":"Cve 2018 2380","source":"github","url":"https://github.com/erpscanteam/CVE-2018-2380","maturity":"poc","reliabilityScore":0.3,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null},{"id":"44292","name":"SAP NetWeaver AS JAVA CRM - Log injection Remote Command Execution","source":"exploit-database","url":"https://www.exploit-db.com/exploits/44292","maturity":"poc","reliabilityScore":0.5,"verified":false,"type":"remote","platforms":["windows"],"requiresAuth":null,"exploitdb":{"verified":false,"type":"remote","platform":"windows","file":"exploits/windows/remote/44292.py","codes":["CVE-2018-2380"]},"metasploit":null}],"exploitCount":2,"weaknesses":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","description":"The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/22.html"}],"affected":[{"vendor":"sap se","product":"sap crm","name":"SAP CRM","label":"sap crm","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"7.01","noFixRecorded":false,"fixedIn":null},{"text":"7.02","noFixRecorded":false,"fixedIn":null},{"text":"7.30","noFixRecorded":false,"fixedIn":null},{"text":"7.31","noFixRecorded":false,"fixedIn":null},{"text":"7.33","noFixRecorded":false,"fixedIn":null},{"text":"7.54","noFixRecorded":false,"fixedIn":null}],"versionsText":"7.01 | 7.02 | 7.30 | 7.31 | 7.33 | 7.54","eol":null,"hubHref":"/vendor/sap_se/sap_crm"},{"vendor":"sap","product":"customer_relationship_management","name":"customer relationship management","label":"customer_relationship_management","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"701","noFixRecorded":false,"fixedIn":null},{"text":"702","noFixRecorded":false,"fixedIn":null},{"text":"730","noFixRecorded":false,"fixedIn":null},{"text":"731","noFixRecorded":false,"fixedIn":null},{"text":"733","noFixRecorded":false,"fixedIn":null},{"text":"754","noFixRecorded":false,"fixedIn":null}],"versionsText":"701 | 702 | 730 | 731 | 733 | 754","eol":null,"hubHref":"/vendor/sap/customer_relationship_management"}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/erpscanteam/CVE-2018-2380","label":"github.com/erpscanteam/CVE-2018-2380","hostname":"github.com","tags":["X Refsource MISC","Exploit","Third Party Advisory"]},{"url":"https://www.exploit-db.com/exploits/44292/","label":"www.exploit-db.com/exploits/44292/","hostname":"www.exploit-db.com","tags":["Exploit","X Refsource EXPLOIT DB","Third Party Advisory","VDB Entry"]},{"url":"https://launchpad.support.sap.com/#/notes/2547431","label":"launchpad.support.sap.com","hostname":"launchpad.support.sap.com","tags":["X Refsource CONFIRM","Permissions Required"]},{"url":"http://www.securityfocus.com/bid/103001","label":"www.securityfocus.com/bid/103001","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID","Broken Link","Third Party Advisory"]},{"url":"https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/","label":"blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/","hostname":"blogs.sap.com","tags":["X Refsource CONFIRM","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-2380","label":"www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-2380","hostname":"www.cisa.gov","tags":["Government Resource","US Government Resource"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2018-03-01T17:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"kev-added","date":"2021-11-03T00:00:00.000Z","label":"Added to CISA KEV","detail":"SAP Customer Relationship Management (CRM) Path Traversal Vulnerability","source":"cisa"},{"kind":"kev-due","date":"2022-05-03T00:00:00.000Z","label":"CISA remediation due","detail":"Apply updates per vendor instructions.","source":"cisa"},{"kind":"modified","date":"2025-10-21T23:45:56.073Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":90,"level":"critical","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-22T09:52:37.764Z","stale":false,"partial":false}}