CVE-2023-7216

2024-02-0515:15:08

CWE-59

CWE-22

[email protected]

web.nvd.nist.gov

cpio

path traversal

vulnerability

remote

file write

symlinks

5.3 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

5.3 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

44.6%

JSON

A path traversal vulnerability was found in the CPIO utility. This issue could allow a remote unauthenticated attacker to trick a user into opening a specially crafted archive. During the extraction process, the archiver could follow symlinks outside of the intended directory, which allows files to be written in arbitrary directories through symlinks.