7.3 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
HIGH
Availability Impact
LOW
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
9.9 High
AI Score
Confidence
High
0.006 Low
EPSS
Percentile
78.8%
SharpZipLib (or #ziplib) is a Zip, GZip, Tar and BZip2 library. Prior to version 1.3.3, a TAR file entry ../evil.txt
may be extracted in the parent directory of destFolder
. This leads to arbitrary file write that may lead to code execution. The vulnerability was patched in version 1.3.3.
[
{
"product": "sharpziplib",
"vendor": "icsharpcode",
"versions": [
{
"lessThan": "1.3.3",
"status": "affected",
"version": "1.3.3",
"versionType": "custom"
},
{
"lessThan": "0.86.0*",
"status": "affected",
"version": "0.86.0",
"versionType": "custom"
}
]
}
]
7.3 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
HIGH
Availability Impact
LOW
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
9.9 High
AI Score
Confidence
High
0.006 Low
EPSS
Percentile
78.8%