Medium severity6.6CISA KEVNVD Advisory· Published Mar 1, 2018· Updated Jun 17, 2026

CVE-2018-2380

Description

SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing "traverse to parent directory" are passed through to the file APIs.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Frappe/CRMllm-fuzzy
Range: 7.01, 7.02, 7.30, 7.31, 7.33, 7.54
SAP SE/SAP CRMv5
Range: 7.01

Patches

Vulnerability mechanics

References

www.exploit-db.com/exploits/44292/nvdExploitThird Party AdvisoryVDB Entry
www.securityfocus.com/bid/103001nvdBroken LinkThird Party AdvisoryVDB Entry
blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/nvdVendor Advisory
launchpad.support.sap.comnvdPermissions Required
www.cisa.gov/known-exploited-vulnerabilities-catalognvdUS Government Resource

News mentions

No linked articles in our index yet.

cvss	0.429
epss	0.023
exploit	0.030
kev	0.120
patch	0.000
ransomware	0.060