SAP SE SAP CRM
En bref
- Source
- NVD
- EPSS
- EPSS 28.93 % · centile 98 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- sap
- Statut NVD
- Analyzed
Description
SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing "traverse to parent directory" are passed through to the file APIs.
Faiblesses (CWE)
- CWE-22 — Traversée de répertoire
Références
- https://github.com/erpscanteam/CVE-2018-2380
- https://www.exploit-db.com/exploits/44292/
- https://launchpad.support.sap.com/#/notes/2547431
- http://www.securityfocus.com/bid/103001
- https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-2380
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 6.6 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L | CISA-ADP |
| CVSS 3.1 | MEDIUM 6.6 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L | NVD · nvd@nist.gov (Primary) |
| CVSS 3.1 | MEDIUM 6.6 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L | NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) |
| CVSS 2.0 | MEDIUM 6.5 | AV:N/AC:L/Au:S/C:P/I:P/A:P | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2018-14235
- GCVE · GCVE-0-2018-2380
Configurations affectées (CPE NVD)
cpe:2.3:a:sap:customer_relationship_management:7.01:*:*:*:*:*:*:*cpe:2.3:a:sap:customer_relationship_management:7.02:*:*:*:*:*:*:*cpe:2.3:a:sap:customer_relationship_management:7.30:*:*:*:*:*:*:*cpe:2.3:a:sap:customer_relationship_management:7.31:*:*:*:*:*:*:*cpe:2.3:a:sap:customer_relationship_management:7.33:*:*:*:*:*:*:*cpe:2.3:a:sap:customer_relationship_management:7.54:*:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| SAP SE · SAP CRM | affected 7.01 ; affected 7.02 ; affected 7.30 ; affected 7.31 ; affected 7.33 ; affected 7.54 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| CISA Known Exploited Vulnerabilities | CC0 1.0 |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |