Cloud Foundry Archiver vulnerable to path traversal

2022-12-2800:30:23

CWE-22

GitHub Advisory Database

github.com

cloud foundry

archiver

path traversal

vulnerability

improper path sanitation

relative file paths

file manipulation

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

EPSS

0.001

Percentile

46.6%

JSON

Due to improper path santization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory.

Affected configurations

Vulners

Node

code.cloudfoundry.orgarchiverRange<0.0.0-20180523222229-09b5706aa936

cloudfoundryarchiverRange<0.0.0-20180523222229-09b5706aa936

VendorProductVersionCPE
code.cloudfoundry.orgarchiver*cpe:2.3:a:code.cloudfoundry.org:archiver:*:*:*:*:*:*:*:*
cloudfoundryarchiver*cpe:2.3:a:cloudfoundry:archiver:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
code.cloudfoundry.org	archiver	*	cpe:2.3:a:code.cloudfoundry.org:archiver::::::::
cloudfoundry	archiver	*	cpe:2.3:a:cloudfoundry:archiver::::::::