SAP · Customer Relationship Management (CRM)
CVE-2018-2380
SAP Customer Relationship Management (CRM) Path Traversal Vulnerability
What it is
SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing "traverse to parent directory" are passed through to the file APIs.
CISA: SAP Customer Relationship Management (CRM) contains a path traversal vulnerability that allows an attacker to exploit insufficient validation of path information provided by users.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: May 3, 2022
More exploited flaws from SAP
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| May 15, 2025 | Deserialization | NetWeaver | Critical 9.1 | 13% |
| Apr 29, 2025 | Unrestricted File Upload | NetWeaver | Critical 10.0 | 99.5% |
| Mar 19, 2025 | Directory Traversal | NetWeaver | High 7.5 | 95% |
| Sep 30, 2024 | Deserialization of Untrusted Data | Commerce Cloud | Critical 9.8 | 7.5% |
| Aug 18, 2022 | HTTP Request Smuggling | Multiple Products | Critical 9.8 | 98% |
| Jun 9, 2022 | SQL Injection | NetWeaver | Critical 9.8 | 72% |
| Jun 9, 2022 | Information Disclosure | NetWeaver | Medium 5.3 | 52% |
| Jun 9, 2022 | Unrestricted File Upload | NetWeaver | Critical 9.9 | 37% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.