GitHub Advisory DatabaseGHSA-C2CC-3569-6JH2Path traversal in ZIPFoundation
7.8 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
0.001 Low
EPSS
Percentile
20.4%
An issue in ZIPFoundation v0.9.16 allows attackers to execute a path traversal via extracting a crafted zip file.
Affected configurations
| CPE | Name | Operator | Version |
|---|---|---|---|
| github.com/weichsel/zipfoundation | le | 0.9.17 |
References
blog.ostorlab.co/zip-packages-exploitation.html
github.com/advisories/GHSA-c2cc-3569-6jh2
github.com/weichsel/ZIPFoundation/issues/282
github.com/weichsel/ZIPFoundation/releases/tag/0.9.18
nvd.nist.gov/vuln/detail/CVE-2023-39138
ostorlab.co/vulndb/advisory/OVE-2023-4
ostorlab.co/vulndb/advisory/OVE-2023-6
Related
7.8 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
0.001 Low
EPSS
Percentile
20.4%