{"affected":[{"affectedData":[{"product":"SAP Crystal Reports Server, OEM Edition","vendor":"SAP SE","versions":[{"status":"affected","version":"4.0"},{"status":"affected","version":"4.10"},{"status":"affected","version":"4.20"},{"status":"affected","version":"4.30"}]}],"source":"cna@sap.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:sap:crystal_reports_server:4.0:*:*:*:oem:*:*:*","matchCriteriaId":"12FDA56B-45AD-4126-96C3-726524081BE2","vulnerable":true},{"criteria":"cpe:2.3:a:sap:crystal_reports_server:4.10:*:*:*:oem:*:*:*","matchCriteriaId":"C8465CC0-E9C0-4089-A8EC-37128AEC02B6","vulnerable":true},{"criteria":"cpe:2.3:a:sap:crystal_reports_server:4.20:*:*:*:oem:*:*:*","matchCriteriaId":"1899E034-AF66-44A2-969A-BA73F683AC85","vulnerable":true},{"criteria":"cpe:2.3:a:sap:crystal_reports_server:4.30:*:*:*:oem:*:*:*","matchCriteriaId":"8BEFC095-E50B-413C-9152-E7ECBDC74B76","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"Unquoted windows search path (directory/path traversal) vulnerability in Crystal Reports Server, OEM Edition (CRSE), 4.0, 4.10, 4.20, 4.30, startup path."},{"lang":"es","value":"Vulnerabilidad de ruta de búsqueda de windows sin entrecomillar (salto de directorio/ruta) en la ruta de inicio en Crystal Reports Server OEM Edition (CRSE), en versiones 4.0, 4.10, 4.20 y 4.30."}],"id":"CVE-2018-2406","lastModified":"2026-06-17T01:55:39.060","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"MEDIUM","cvssData":{"accessComplexity":"LOW","accessVector":"LOCAL","authentication":"NONE","availabilityImpact":"PARTIAL","baseScore":4.6,"confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","vectorString":"AV:L/AC:L/Au:N/C:P/I:P/A:P","version":"2.0"},"exploitabilityScore":3.9,"impactScore":6.4,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"nvd@nist.gov","type":"Primary","userInteractionRequired":false}],"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","version":"3.0"},"exploitabilityScore":1.8,"impactScore":3.4,"source":"cna@sap.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"LOW","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","version":"3.0"},"exploitabilityScore":1.8,"impactScore":3.4,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2018-04-10T15:29:01.363","references":[{"source":"cna@sap.com","tags":["Broken Link"],"url":"http://www.securityfocus.com/bid/103719"},{"source":"cna@sap.com","tags":["Vendor Advisory"],"url":"https://blogs.sap.com/2018/04/10/sap-security-patch-day-april-2018/"},{"source":"cna@sap.com","tags":["Permissions Required"],"url":"https://launchpad.support.sap.com/#/notes/2560132"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link"],"url":"http://www.securityfocus.com/bid/103719"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"url":"https://blogs.sap.com/2018/04/10/sap-security-patch-day-april-2018/"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Permissions Required"],"url":"https://launchpad.support.sap.com/#/notes/2560132"}],"sourceIdentifier":"cna@sap.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-428"}],"source":"nvd@nist.gov","type":"Primary"}]}