CVE-2021-22571

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

A local attacker could read files from some other users' SA360 reports stored in the /tmp folder during staging process before the files are loaded in BigQuery. We recommend upgrading to version 1.0.3 or above.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-275 CWE-276

Affected software

Vendor	Product	Versions
Google LLC	google/sa360-webquery-bigquery	>= unspecified, <= 1.0.2

References

https://github.com/JLLeitschuh/security-research/security/advisories/GHSA-7fjx-657r-9r5hThird Party Advisory
https://github.com/google/sa360-webquery-bigquery/pull/15Patch, Third Party Advisory
https://github.com/google/sa360-webquery-bigquery/releases/tag/v1.0.3Release Notes, Third Party Advisory
https://github.com/JLLeitschuh/security-research/security/advisories/GHSA-7fjx-657r-9r5hThird Party Advisory
https://github.com/google/sa360-webquery-bigquery/pull/15Patch, Third Party Advisory
https://github.com/google/sa360-webquery-bigquery/releases/tag/v1.0.3Release Notes, Third Party Advisory

Timeline

Published: Mar 18, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-225725.5On unix-like systems, the system temporary directory is shared between all users on that system. The root cause is File.createTempFile creat CVE-2021-225737.3The vulnerability is that IDToken verifier does not verify if token is properly signed. Signature verification makes sure that the token's p CVE-2021-22588.1Vulnerability in the Oracle Projects product of Oracle E-Business Suite (component: User Interface). Supported versions that are affected ar CVE-2021-22598.1Vulnerability in the Oracle Payables product of Oracle E-Business Suite (component: India Localization, Results). Supported versions that ar CVE-2021-22608.1Vulnerability in the Oracle Human Resources product of Oracle E-Business Suite (component: iRecruitment). The supported version that is affe CVE-2021-226007.0A double free bug in packet_set_ring() in net/packet/af_packet.c can be exploited by a local user through crafted syscalls to escalate privi CVE-2021-22618.1Vulnerability in the Oracle Lease and Finance Management product of Oracle E-Business Suite (component: Quotes). Supported versions that are CVE-2021-22628.1Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Endeca). The supported version that is affected is 12.CVE-2021-22638.1Vulnerability in the Oracle Sourcing product of Oracle E-Business Suite (component: Intelligence, RFx). Supported versions that are affected CVE-2021-226367.8Texas Instruments TI-RTOS, when configured to use HeapMem heap(default), malloc returns a valid pointer to a small buffer on extremely large CVE-2021-226377.8Multiple stack-based buffer overflow issues have been identified in the way the application processes project files, allowing an attacker to CVE-2021-226387.8Fatek FvDesigner Version 1.5.76 and prior is vulnerable to an out-of-bounds read while processing project files, allowing an attacker to cra