Lucene search

K
veracodeVeracode Vulnerability DatabaseVERACODE:43074
HistorySep 01, 2023 - 11:24 a.m.

Path Traversal

2023-09-0111:24:44
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
4
zip slip
path traversal
vulnerability
zip extraction
rce
data overwrite

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

20.2%

Zip Swift is vulnerable to Zip Path Traversal vulnerability (Zip Slip). The vulnerability is due to not sanitizing zip entry while extracting zip files in a destination directory inside a unzipFile function. An attacker can a create a maliciously crafted zip entry which can be extracted to arbitrary locations outside the destination directory causing overwriting sensitive user data or possibly resulting in RCE.

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

20.2%