Vulnerability Intelligence Report
SAP Customer Relationship Management (CRM) Path Traversal Vulnerability
CVE-2018-2380
SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing "traverse to parent directory" are passed through to the file APIs.
CISA KEV
SSVC: Active Exploitation
CVSS Base Score
6.6
MEDIUM
Exploitability:2.3
Impact Score:3.8
EPSS Probability:29.23%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-22 ↗CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| SAP SE | SAP CRM | 7.01 (affected), 7.02 (affected), 7.30 (affected), 7.31 (affected), 7.33 (affected), 7.54 (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | SAP SE · Vendor · Germany |
| Reserved | 2017-12-15T00:00:00 |
| Published | 2018-03-01T17:00:00 |
| Patch Date | 2018-02-13 |
| Last Updated | 2025-10-21T23:45:56 |
Community Chatter & Buzz