PT-2022-9255 · Sa360 · Sa360

Jonathan Leitschuh + 1 · Published 2022-03-18 · Updated 2022-05-10 · CVE-2021-22571

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions SA360 versions prior to 1.0.3

Description A local attacker could read files from some other users' SA360 reports stored in the /tmp folder during the staging process before the files are loaded in BigQuery.

Recommendations For versions prior to 1.0.3, upgrade to version 1.0.3 or above.

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

CWE-275

Related Identifiers

CVE-2021-22571

GHSA-7FJX-657R-9R5H

Affected Products

Sa360

References · 6

• https://github.com/google/sa360-webquery-bigquery/pull/15 · Patch
• https://osv.dev/vulnerability/CVE-2021-22571 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-22571 · Security Note
• https://github.com/google/sa360-webquery-bigquery/releases/tag/v1.0.3 · Note
• https://github.com/JLLeitschuh/security-research/security/advisories/GHSA-7fjx-657r-9r5h · Note
• https://t.me/cibsecurity/39193 · Telegram Post