SAP Customer Relationship Management vulnerabilities

10 CVEs affecting SAP Customer Relationship Management, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-27897, published 2023-04-11.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2018-2380: SAP Customer Relationship Management (CRM) Path Traversal Vulnerability, published 2018-03-01. Medium severity, CVSS 6.6. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 28.9% chance of exploitation in the next 30 days. SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing "traverse to parent directory"…
CVE-2014-8669, published 2014-11-06. High severity, CVSS 10.0. EPSS: 5.5% chance of exploitation in the next 30 days. The SAP Promotion Guidelines (CRM-MKT-MPL-TPM-PPG) module for SAP CRM allows remote attackers to execute arbitrary code via unspecified vectors.
CVE-2015-3979, published 2015-05-12. High severity, CVSS 7.5. EPSS: 2.4% chance of exploitation in the next 30 days. Unspecified vulnerability in the Business Rules Framework (CRM-BF-BRF) in SAP CRM allows attackers to execute arbitrary code via unknown vectors, aka SAP Security Note 2097534.
CVE-2013-7095, published 2013-12-13. High severity, CVSS 10.0. EPSS: 2.1% chance of exploitation in the next 30 days. The XML parser (crm_flex_data) in SAP Customer Relationship Management (CRM) 7.02 EHP 2 has unknown impact and attack vectors related to an XML External Entity (XXE) issue.
CVE-2014-1962, published 2014-02-14. Medium severity, CVSS 5.0. EPSS: 1.5% chance of exploitation in the next 30 days. Gwsync in SAP CRM 7.02 EHP 2 allows remote attackers to obtain sensitive information via unspecified vectors, related to an XML External Entity (XXE) issue.
CVE-2015-3980, published 2015-05-12. High severity, CVSS 7.5. EPSS: 1.4% chance of exploitation in the next 30 days. SQL injection vulnerability in the Business Rules Framework (CRM-BF-BRF) in SAP CRM allows attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2097534.
CVE-2017-15294, published 2017-10-16. Medium severity, CVSS 6.1. EPSS: 1% chance of exploitation in the next 30 days. The Java administration console in SAP CRM has XSS. This is SAP Security Note 2478964.
CVE-2021-33676, published 2021-07-14. High severity, CVSS 7.2. EPSS: 0.9% chance of exploitation in the next 30 days. A missing authority check in SAP CRM, versions - 700, 701, 702, 712, 713, 714, could be leveraged by an attacker with high privileges to compromise confidentiality, integrity, or availability of the…
CVE-2023-27897, published 2023-04-11. Medium severity, CVSS 6.3. EPSS: 0.7% chance of exploitation in the next 30 days. In SAP CRM - versions 700, 701, 702, 712, 713, an attacker who is authenticated with a non-administrative role and a common remote execution authorization can use a vulnerable interface to execute an…
CVE-2017-15296, published 2017-10-16. High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days. The Java component in SAP CRM has CSRF. This is SAP Security Note 2478964.