CVE-2024-1485

2024-02-1400:15:46

CWE-23

[email protected]

web.nvd.nist.gov

registry-support

decompression function

unauthenticated remote attacker

malicious archive

overwrite

delete files

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:H

AI Score

7.7

Confidence

High

EPSS

Percentile

15.5%

JSON

A flaw was found in the decompression function of registry-support. This issue can be triggered if an unauthenticated remote attacker tricks a user into parsing a devfile which uses the parent or plugin keywords. This could download a malicious archive and cause the cleanup process to overwrite or delete files outside of the archive, which should not be allowed.