Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
prionPRIOn knowledge basePRION:CVE-2018-20250
HistoryFeb 05, 2019 - 8:29 p.m.

Path traversal

2019-02-0520:29:00
PRIOn knowledge base
www.prio-n.com
6

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

7.7 High

AI Score

Confidence

High

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.974 High

EPSS

Percentile

99.9%

JSON

In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field of the ACE format (in UNACEV2.dll). When the filename field is manipulated with specific patterns, the destination (extraction) folder is ignored, thus treating the filename as an absolute path.

CPENameOperatorVersion
winrarle5.61

Related

malwarebytes 1
thn 3
zdt 2
attackerkb 1
checkpoint_advisories 1
threatpost 3
cisa_kev 1
fireeye 2
talosblog 1
cve 1
packetstorm 1
openvas 1
mssecure 2
securelist 2
kaspersky 1
nessus 1
myhack58 1
cisa 1
qualysblog 1
malwarebytes
malwarebytes
A week in security (March 11 – 17)
2019-03-18 14:57:10
thn
thn
Patched WinRAR Bug Still Under Active Attack—Thanks to No Auto-Updates
2019-03-15 08:00:00
Latest WinRAR Flaw Being Exploited in the Wild to Hack Windows Computers
2019-02-26 13:40:00
Elfin Hacking Group Targets Multiple U.S. and Saudi Arabian Firms
2019-03-28 08:18:00
zdt
zdt
WinRAR 5.61 - Path Traversal Exploit
2019-03-18 00:00:00
RARLAB WinRAR ACE Format Input Validation Remote Code Execution Exploit
2019-04-24 00:00:00
attackerkb
attackerkb
CVE-2018-20250
2019-02-05 00:00:00
checkpoint_advisories
checkpoint_advisories
RARLAB WinRaR ACE Format Input Validation Remote Code Execution (CVE-2018-20250)
2019-02-13 00:00:00
threatpost
threatpost
Cybercriminals Have a Heyday with WinRAR Bug in Fresh Campaigns
2019-03-27 15:26:00
Critical WinRAR Flaw Found Actively Being Exploited
2019-02-26 14:51:04
19-Year-Old WinRAR Flaw Plagues 500 Million Users
2019-02-21 15:05:45
cisa_kev
cisa_kev
WinRAR Absolute Path Traversal Vulnerability
2022-02-15 00:00:00
fireeye
fireeye
WinRAR Zero-day Abused in Multiple Campaigns
2019-03-26 15:30:00
Think Fast: Time Between Disclosure, Patch Release and Vulnerability Exploitation — Intelligence for Vulnerability Management, Part Two
2020-04-13 00:00:00
talosblog
talosblog
What the continued escalation of tensions in the Middle East means for security
2020-01-09 10:13:06
cve
cve
CVE-2018-20250
2019-02-05 20:29:00
packetstorm
packetstorm
RARLAB WinRAR ACE Format Input Validation Remote Code Execution
2019-04-24 00:00:00
openvas
openvas
WinRAR <= 5.61 Absolute Path Traversal Vulnerability
2022-08-12 00:00:00
mssecure
mssecure
Inside Microsoft Threat Protection: Mapping attack chains from cloud to endpoint
2020-06-18 16:00:03
Analysis of a targeted attack exploiting the WinRAR CVE-2018-20250 vulnerability
2019-04-10 15:00:58
securelist
securelist
IT threat evolution Q1 2019
2019-05-23 10:00:14
IT threat evolution Q1 2019. Statistics
2019-05-23 10:00:53
kaspersky
kaspersky
KLA11427 Multiple ACE vulnerabilities in WinRAR
2019-02-05 00:00:00
nessus
nessus
RARLAB WinRAR < 5.70 Beta 1 Multiple Vulnerabilities
2019-02-27 00:00:00
myhack58
myhack58
WinRAR aeration elder has a major vulnerability that hackers can be malicious programs implanted in the boot process-vulnerability warning-the black bar safety net
2019-02-22 00:00:00
cisa
cisa
CISA Adds Nine Known Exploited Vulnerabilities to Catalog
2022-02-15 00:00:00
qualysblog
qualysblog
Top 19+ Vulnerability CVEs in Santa’s Dashboard Tracking
2019-12-27 18:01:22

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

7.7 High

AI Score

Confidence

High

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.974 High

EPSS

Percentile

99.9%

JSON
Related for PRION:CVE-2018-20250
malwarebytes1thn3zdt2attackerkb1checkpoint_advisories1threatpost3cisa_kev1fireeye2talosblog1cve1packetstorm1openvas1mssecure2securelist2kaspersky1nessus1myhack581cisa1qualysblog1