Lucene search

GoogleOSV:CVE-2020-36628

HistoryDec 25, 2022 - 11:15 a.m.

CVE-2020-36628

2022-12-2511:15:10

Google

osv.dev

calsign apde

zip file handler

vulnerability

path traversal

upgrade

version 0.5.2-pre2-alpha

vdb-216747

software

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

6.9

Confidence

Low

EPSS

0.002

Percentile

58.7%

JSON

A vulnerability classified as critical has been found in Calsign APDE. This affects the function handleExtract of the file APDE/src/main/java/com/calsignlabs/apde/build/dag/CopyBuildTask.java of the component ZIP File Handler. The manipulation leads to path traversal. Upgrading to version 0.5.2-pre2-alpha is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216747.

References

github.com/Calsign/APDE/commit/c6d64cbe465348c1bfd211122d89e3117afadecf

github.com/Calsign/APDE/releases/tag/v0.5.2-pre2-alpha

vuldb.com/?id.216747

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

6.9

Confidence

Low

EPSS

0.002

Percentile

58.7%

JSON

Related for OSV:CVE-2020-36628