GHSA-4p7q-px7w-p3p9

GHSA-4p7q-px7w-p3p9 PUBLISHED

Record from GitHub Advisory Database · Published May 24, 2022

SAP Cloud Connector, version - 2.0, allows the upload of zip files as backup. This backup file can be tricked to inject special elements such as '..' and '/' separators, for attackers to escape outside of the restricted location to access files or directories.

Timeline

May 24, 2022 CVE Published
Apr 29, 2026 Security Advisory

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln GHSA-4p7q-px7w-p3p9
vulnetix vdb fixes GHSA-4p7q-px7w-p3p9

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GHSA-4p7q-px7w-p3p9/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

https://launchpad.support.sap.com/#/notes/3058553 url
https://nvd.nist.gov/vuln/detail/CVE-2021-33692 advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=582222806 url

Look up in the Resolve Platform →