CVE-2024-21518

2024-06-2205:15:11

CWE-22

CWE-29

[email protected]

web.nvd.nist.gov

opencart

zip slip

vulnerability

filesystem traversal

web root

arbitrary files

7.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

0.001 Low

EPSS

Percentile

41.6%

JSON

This affects versions of the package opencart/opencart from 4.0.0.0. A Zip Slip issue was identified via the marketplace installer due to improper sanitization of the target path, allowing files within a malicious archive to traverse the filesystem and be extracted to arbitrary locations. An attacker can create arbitrary files in the web root of the application and overwrite other existing files by exploiting this vulnerability.

Affected configurations

NVD

Node

opencartopencartRange4.0.0.0≥

CPENameOperatorVersion
opencart:opencartopencarteq*

CPE	Name	Operator	Version
opencart:opencart	opencart	eq	*

CNA Affected

[
  {
    "product": "opencart/opencart",
    "versions": [
      {
        "version": "4.0.0.0",
        "lessThan": "*",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "vendor": "n/a"
  }
]