CVE-2018-2380

CVE-2018-2380 is a path traversal flaw (CWE-22) in SAP Customer Relationship Management (CRM) caused by insufficient validation of path information supplied by users. An attacker triggers it by submitting crafted path input to the vulnerable CRM functionality, allowing requests to reach files or directories outside the intended scope. Successful exploitation can enable unauthorized access to or manipulation of files on the SAP CRM server, potentially supporting further compromise; CISA notes known ransomware use. Any organization running SAP CRM is potentially affected, with risk concentrated in deployments where the application is reachable by untrusted users. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03), and EPSS assigns a high 28.9% probability of exploitation within 30 days (98th percentile), though no public proof-of-concept is known.

What to do: Apply SAP's security updates per vendor instructions as required by CISA, and identify all SAP CRM instances in your environment, prioritizing any that are internet-facing. Because ransomware use is known, verify the integrity of affected SAP servers and restrict network access to them from untrusted networks. Check with SAP's advisory for the specific affected releases, since the provided data does not enumerate version ranges.