CVE-2018-2380
SAP Customer Relationship Management (CRM) Path Traversal Vulnerability
Description
CVE-2018-2380 is a medium-severity path traversal vulnerability affecting SAP Customer Relationship Management (CRM). The SAP CRM application fails to properly validate path information supplied by users, allowing attackers with high privileges to use directory traversal sequences to access files and directories outside the intended restricted area. This vulnerability is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog with confirmed active exploitation, and it is known to be used in ransomware campaigns. With an EPSS score of 45.53% (97.6th percentile), CVE-2018-2380 has a very high probability of exploitation in the wild.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:LOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| sap | customer relationship management | 7.01; 7.02; 7.30; 7.31; 7.33; 7.54 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
References
- http://www.securityfocus.com/bid/103001(Broken Link, Third Party Advisory, VDB Entry)
- https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/(Vendor Advisory)
- https://github.com/erpscanteam/CVE-2018-2380(Exploit, Third Party Advisory)
- https://launchpad.support.sap.com/#/notes/2547431(Permissions Required)
- https://www.exploit-db.com/exploits/44292/(Exploit, Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-2380(US Government Resource)
Weakness Type
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Path Traversal is a vulnerability that occurs when software uses external input to construct a pathname without properly validating it, allowing attackers to traverse outside the intended directory. In the case of SAP CRM, insufficient validation of user-supplied path information allows characters representing "traverse to parent directory" to be passed through to file APIs, enabling unauthorized file access.
Learn more: CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Impact Analysis
CVE-2018-2380 carries a CVSS 3.1 score of 6.6 (MEDIUM), reflecting a significant but not maximum-severity threat. The vulnerability is exploitable over the network with low attack complexity, though it requires high-level privileges to exploit. No user interaction is needed, and the scope is changed, meaning exploitation can impact resources beyond the vulnerable SAP CRM component itself. While the individual impact on confidentiality, integrity, and availability is rated low, the changed scope amplifies the overall risk. The EPSS score of 45.53% places this vulnerability in the 97.6th percentile, indicating a very high likelihood of active exploitation. Critically, this vulnerability is known to be used in ransomware campaigns, which significantly elevates the urgency for remediation.
Exploit Maturity
CVE-2018-2380 has mature exploit code publicly available. Public exploit code is available via Exploit-DB and GitHub (erpscanteam), significantly lowering the barrier to exploitation. CISA has confirmed active exploitation in the wild by including this vulnerability in the Known Exploited Vulnerabilities catalog, and it is additionally flagged as known to be leveraged in ransomware campaigns. The EPSS score of 45.53% (97.6th percentile) indicates a very high probability of exploitation activity. Federal agencies were required to remediate this vulnerability by 2022-05-03 per CISA's binding operational directive.
Remediation
- Apply vendor patches immediately as mandated by CISA KEV: Apply updates per vendor instructions. SAP Security Note 2547431 addresses this vulnerability.
- Upgrade all affected SAP CRM instances (versions 7.01, 7.02, 7.30, 7.31, 7.33, and 7.54) to the latest patched versions available from SAP.
- Implement strict input validation on all user-supplied path parameters, using canonical path resolution to prevent directory traversal sequences such as "../" from reaching file system APIs.
- Restrict network access to SAP CRM administrative interfaces using firewall rules and network segmentation, and enforce the principle of least privilege for all user accounts.
- Monitor file system access logs for anomalous directory traversal patterns and conduct threat hunting for indicators of compromise, particularly given the known ransomware association.
Technical Details
CVE-2018-2380 is a path traversal vulnerability in SAP CRM versions 7.01, 7.02, 7.30, 7.31, 7.33, and 7.54. The application fails to properly sanitize user-supplied path information before passing it to file system APIs, allowing directory traversal sequences such as "../" to escape the intended directory scope. The attack vector is network-based with low complexity, though it requires high privileges (CVSS vector: AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L). The changed scope indicates that successful exploitation can affect resources outside the SAP CRM component boundary, potentially allowing an attacker to read or modify files on the underlying server that should not be accessible through the CRM interface.
Frequently Asked Questions
Is CVE-2018-2380 being actively exploited?
Yes. CVE-2018-2380 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Additionally, this vulnerability is known to be used in ransomware campaigns. The EPSS score of 45.53% (97.6th percentile) further indicates a very high exploitation probability.
What products are affected by CVE-2018-2380?
CVE-2018-2380 affects SAP Customer Relationship Management (CRM) versions 7.01, 7.02, 7.30, 7.31, 7.33, and 7.54. Organizations running any of these versions should prioritize remediation immediately.
How do I fix CVE-2018-2380?
Apply updates per SAP vendor instructions, specifically SAP Security Note 2547431. Upgrade all affected SAP CRM instances to the latest patched versions. If immediate patching is not possible, restrict network access to CRM interfaces and monitor file system access for directory traversal attempts.
How severe is CVE-2018-2380?
CVE-2018-2380 has a CVSS 3.1 score of 6.6 (MEDIUM). While the base severity is medium, the confirmed ransomware usage, active exploitation in the wild, and very high EPSS score of 45.53% (97.6th percentile) make this a high-priority vulnerability requiring urgent attention.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.