CVE-2021-33692: Path Traversal

Published Sep 15, 2021

Updated

SAP Cloud Connector, version - 2.0, allows the upload of zip files as backup. This backup file can be tricked to inject special elements such as '..' and '/' separators, for attackers to escape outside of the restricted location to access files or directories.

Affected Software

1 affected component

SAP Cloud Connector=2.0

Remediation

Patch Available

https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=582222806

Event History

Sep 15, 2021

CVE Published

via MITRE·06:01 PM

Data Sourced

via MITRE·06:01 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2021-33692?

CVE-2021-33692 is classified as a high severity vulnerability with potential for unauthorized file access.

How do I fix CVE-2021-33692?

To mitigate CVE-2021-33692, update SAP Cloud Connector to the latest version that addresses this vulnerability.

What type of attack does CVE-2021-33692 enable?

CVE-2021-33692 allows attackers to exploit file path traversal to access sensitive files or directories.

Is CVE-2021-33692 exploitable remotely?

Yes, CVE-2021-33692 can be exploited remotely if the SAP Cloud Connector is accessible over the network.

What versions of SAP Cloud Connector are affected by CVE-2021-33692?

SAP Cloud Connector version 2.0 is specifically affected by CVE-2021-33692.