Описание
adm-zip npm library before 0.4.9 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.
Ссылки
- Third Party AdvisoryVDB Entry
- Issue TrackingPatchThird Party Advisory
- ExploitIssue TrackingPatchThird Party Advisory
- ExploitThird Party Advisory
- ExploitThird Party Advisory
- ExploitThird Party Advisory
- Third Party AdvisoryVDB Entry
- Issue TrackingPatchThird Party Advisory
- ExploitIssue TrackingPatchThird Party Advisory
- ExploitThird Party Advisory
- ExploitThird Party Advisory
- ExploitThird Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 0.4.9 (исключая)
cpe:2.3:a:adm-zip_project:adm-zip:*:*:*:*:*:node.js:*:*
EPSS
Процентиль: 95%
0.17577
Средний
5.5 Medium
CVSS3
4.3 Medium
CVSS2
Дефекты
CWE-22
CWE-22
Связанные уязвимости
CVSS3: 5.3
redhat
около 11 лет назад
adm-zip npm library before 0.4.9 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.
CVSS3: 9.6
fstec
больше 7 лет назад
Уязвимость функции extractDir библиотеки Node.js для работы с zip-файлами Adm-zip, позволяющая нарушителю выполнить произвольный код
EPSS
Процентиль: 95%
0.17577
Средний
5.5 Medium
CVSS3
4.3 Medium
CVSS2
Дефекты
CWE-22
CWE-22