Published: 01/03/2018 Updated: 23/03/2018

CVSS v2 Base Score: 6.5 | Impact Score: 6.4 | Exploitability Score: 8

CVSS v3 Base Score: 6.6 | Impact Score: 3.7 | Exploitability Score: 2.3

VMScore: 655

Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P

Subscribe to Customer Relationship Management

SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an malicious user to exploit insufficient validation of path information provided by users, thus characters representing "traverse to parent directory" are passed through to the file APIs.

Vulnerable Product	Search on Vulmon	Subscribe to Product
sap customer relationship management 7.33
sap customer relationship management 7.01
sap customer relationship management 7.02
sap customer relationship management 7.30
sap customer relationship management 7.31
sap customer relationship management 7.54

#!/usr/bin/env python import argparse import urllib import requests, random from bs4 import BeautifulSoup from requestspackagesurllib3exceptions import InsecureRequestWarning requestspackagesurllib3disable_warnings(InsecureRequestWarning) help_desc = ''' PoC of Remote Command Execution via Log injection on SAP CRM -- ERPScan python crm_rce ...

SAP NetWeaver AS JAVA CRM log injection remote command execution exploit ...

PoC of Remote Command Execution via Log injection on SAP NetWeaver AS JAVA CRM

CVE-2018-2380 (CVSS v3 Base Score: 66/10) PoC of Remote Command Execution via Log injection on SAP NetWeaver AS JAVA CRM Script usage example python crm_rce-CVE-2018-2380py --host 127001 --port 50001 --username administrator --password 123QWEasd --SID DM0 --ssl true Where --host is a SAP server IP --port SAP NetWeaver AS Java port us

SAP: It takes exploit devs about 72 hours to turn one of our security patches into a weapon against customers

The Register • Thomas Claburn in San Francisco • 06 Apr 2021

So please don't delay in applying updates, says, well, everyone Beware the IDEs of March: Microsoft's latest monthly fixes land after frantic Exchange Server updates

SAP and security analysts Onapsis say cyber-criminals are pretty quick to analyze the enterprise software outfit's patches and develop exploits to get into vulnerable systems. In a joint report issued by the two organizations, Mariano Nunez, CEO of Onapsis, cited "conclusive evidence that cyberattackers are actively targeting and exploiting unsecured SAP applications," and warned time was of the essence, reporting "SAP vulnerabilities being weaponized in less than 72 hours since the release of p...

CVE-2018-2380

Vulnerability Summary

Vulnerability Trend

Exploits

Github Repositories

Recent Articles

References

Vulmon Search

About

Products

Connect