Lucene search

MitreCVE-2023-39136

HistoryAug 30, 2023 - 10:15 p.m.

CVE-2023-39136

2023-08-3022:15:08

mitre

web.nvd.nist.gov

cve-2023-39136

ziparchive

denial of service

dos

nvd

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

EPSS

Percentile

14.2%

JSON

An unhandled edge case in the component _sanitizedPath of ZipArchive v2.5.4 allows attackers to cause a Denial of Service (DoS) via a crafted zip file.

Affected configurations

Nvd

Node

ziparchive_projectziparchiveMatch2.5.4

VendorProductVersionCPE
ziparchive_projectziparchive2.5.4cpe:2.3:a:ziparchive_project:ziparchive:2.5.4:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ziparchive_project	ziparchive	2.5.4	cpe:2.3:a:ziparchive_project:ziparchive:2.5.4:::::::*

References

blog.ostorlab.co/zip-packages-exploitation.html

github.com/ZipArchive/ZipArchive/issues/680

ostorlab.co/vulndb/advisory/OVE-2023-2

security.snyk.io/research/zip-slip-vulnerability

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

EPSS

Percentile

14.2%

JSON

Related for CVE-2023-39136