GoogleOSV:GHSA-M8XW-9X5X-6VH3py7zr directory traversal vulnerability
9.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
0.008 Low
EPSS
Percentile
81.3%
A directory traversal vulnerability in the SevenZipFile.extractall() function of the python library py7zr v0.20.0 and earlier allows attackers to write arbitrary files via extracting a crafted 7z file.
References
packetstormsecurity.com/files/170127/py7zr-0.20.0-Directory-Traversal.html
advisory-inbox.githubapp.com/advisory_reviews/GHSA-m8xw-9x5x-6vh3
github.com/miurahr/py7zr
github.com/miurahr/py7zr/commit/1bb43f17515c7f69673a1c88ab9cc72a7bbef406
lessonsec.com/cve/cve-2022-44900
nvd.nist.gov/vuln/detail/CVE-2022-44900
Related
9.1 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
0.008 Low
EPSS
Percentile
81.3%