The vulnerability of the JSZip.loadAsync() function in the Jszip library, a zip file processing tool developed by the OpenJDK development team, allows attackers to write arbitrary files and execute arbitrary commands.

🗓️ 28 Jul 2023 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 2 Views

JSZip.loadAsync flaw in the Jszip library lets remote attackers write files and execute commands via a malicious ZIP.

Reporter	Title	Published	Views	Family All 48
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Tivoli Network Manager IP Edition (ITNM).	29 May 202515:46	–	ibm
IBM Security Bulletins	Security Bulletin: IBM SPSS Analytic Server has addressed multiple security vulnerabilities (CVE-2022-48285, CVE-2022-48285)	22 Nov 202403:54	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cognos Analytics has addressed multiple security vulnerabilities (CVE-2022-48285, CVE-2023-35009, CVE-2023-35011)	28 Sep 202313:59	–	ibm
IBM Security Bulletins	Security Bulletin: There is a vulnerability in JSZip used by IBM Maximo Asset Management (CVE-2022-48285)	31 May 202323:41	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Planning Analytics Workspace is affected but not considered vulnerable to multiple vulnerabilities	26 Mar 202504:04	–	ibm
IBM Security Bulletins	Security Bulletin: Potential Directory Traversal Vulnerability in Apache Ant shipped with IBM Operations Analytics - Log Analysis (CVE-2022-48285)	12 Sep 202409:26	–	ibm
IBM Security Bulletins	Security Bulletin: IBM UrbanCode Build 6.1.7.10 addresses multiple vulnerabilities.	26 Mar 202503:51	–	ibm
IBM Security Bulletins	Security Bulletin: There is a vulnerability in JSZip used by IBM Maximo Manage application in IBM Maximo Application Suite (CVE-2022-48285)	28 Jun 202314:16	–	ibm
IBM Security Bulletins	Security Bulletin: JSZip publicly disclosed vulnerability affects IBM Safer Payments (CVE-2022-48285)	24 Apr 202314:16	–	ibm
IBM Security Bulletins	Security Bulletin: security vulnerabilities are addressed with IBM Business Automation Insights iFixes for January 2026.	23 Feb 202609:25	–	ibm

Vulners

Node

stuart_knightley jszipRange<3.8.0

OR

oracle openjdkMatch11.0.19

Source	Link
exchange	www.exchange.xforce.ibmcloud.com/vulnerabilities/244499
github	www.github.com/Stuk/jszip/commit/2edab366119c9ee948357c02f1206c28566cdf15
github	www.github.com/Stuk/jszip/compare/v3.7.1...v3.8.0
altsp	www.altsp.su/obnovleniya-bezopasnosti/
web	www.web.nvd.nist.gov/view/vuln/detail

27 May 2024 00:00Current

7.1High risk

Vulners AI Score7.1

CVSS 37.3

CVSS 27.5

EPSS0.01411

jszip vulnerability path traversal remote code execution malicious zip restricted directories openjdk