CVE-2018-2380: SAP Customer Relationship Management (CRM) Path Traversal Vulnerability
SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing "traverse to parent directory" are passed through to the file APIs.
Other sources
SAP Customer Relationship Management (CRM) contains a path traversal vulnerability that allows an attacker to exploit insufficient validation of path information provided by users.
— CISA
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Implement strict validation and canonicalization of all user-supplied path inputs in the CRM application: normalize paths, enforce an allowlist of permitted path locations, and reject or sanitize any characters or sequences that represent directory traversal (e.g. ../ and URL-encoded variants) before passing values to file APIs.
SAP Customer Relationship Management (CRM) path_validation = reject or canonicalize path traversal sequences (e.g. ../ and encoded equivalents) - Compensating control
Until a vendor-issued patch is available, apply compensating controls such as WAF rules or other network controls to block requests containing directory-traversal patterns (e.g. ../ and encoded variants), and restrict access to the CRM management and file-related interfaces to trusted IP ranges.
Event History
Frequently Asked Questions
What is the severity of CVE-2018-2380?
CVE-2018-2380 has a medium severity rating due to its potential for unauthorized file access.
How do I fix CVE-2018-2380?
To fix CVE-2018-2380, apply the latest security patches provided by SAP for the affected versions.
Which versions of SAP CRM are affected by CVE-2018-2380?
CVE-2018-2380 affects SAP CRM versions 7.01, 7.02, 7.30, 7.31, 7.33, and 7.54.
What type of vulnerability is CVE-2018-2380?
CVE-2018-2380 is a path traversal vulnerability that allows attackers to exploit insufficient validation of path information.
Can CVE-2018-2380 lead to data leakage?
Yes, CVE-2018-2380 can potentially lead to data leakage by allowing attackers unauthorized access to sensitive files.