Описание
SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing "traverse to parent directory" are passed through to the file APIs.
SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing "traverse to parent directory" are passed through to the file APIs.
Ссылки
- https://nvd.nist.gov/vuln/detail/CVE-2018-2380
- https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018
- https://github.com/erpscanteam/CVE-2018-2380
- https://launchpad.support.sap.com/#/notes/2547431
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-2380
- https://www.exploit-db.com/exploits/44292
- http://www.securityfocus.com/bid/103001
Связанные уязвимости
SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing "traverse to parent directory" are passed through to the file APIs.
Уязвимость системы для управления взаимоотношениями с клиентами SAP Customer Relationship Management (CRM), связанная с неверным ограничением имени пути к каталогу с ограниченным доступом, позволяющая нарушителю выполнить произвольные команды