CVE-2021-33692 — Path Traversal in SE SAP Cloud Connector

CWE-22 — Path Traversal3 documents3 sources
Severity
7.5HIGHNVD
EPSS
0.4%
top 42.50%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
SAP SE SAP Cloud ConnectorSAP Cloud Connector
Timeline
PublishedSep 15
Latest updateMay 24

Description

SAP Cloud Connector, version - 2.0, allows the upload of zip files as backup. This backup file can be tricked to inject special elements such as '..' and '/' separators, for attackers to escape outside of the restricted location to access files or directories.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages2 packages

Patches

Patch: wiki.scn.sap.com ↗Patch: wiki.scn.sap.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-4p7q-px7w-p3p9: SAP Cloud Connector, version - 2↗2022-05-24
▶
CVEList
CVE-2021-33692: SAP Cloud Connector, version - 2↗2021-09-15
▶