CVE-2018-2366

MEDIUM 4.3CVE-2018-2366 · Published 14/03/2018 · updated 17/06/2026

In short

CVE-2018-2366 is a MEDIUM (CVSS 4.3) vulnerability affecting sap business process automation (redwood).
Chance of exploitation in the next 30 days (EPSS): 1.5%, higher than 74.5% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
sap business process automation redwood	`= 9.0= 9.1`	No fix yet

Description

SAP Business Process Automation (BPA) By Redwood, 9.0, 9.1, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing 'traverse to parent directory' are passed through to the file APIs.

References

securityfocus.com/bid/103371 · Third Party Advisory
blogs.sap.com/2018/03/13/sap-security-patch-day-march-2018 · Vendor Advisory
launchpad.support.sap.com · Permissions Required

More vulnerabilities in sap business process automation

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free