CVE-2018-1002208

Опубликовано: 25 июл. 2018

Источник: nvd

CVSS3: 5.5

CVSS2: 4.3

EPSS Средний

Описание

SharpZipLib before 1.0 RC1 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.

Ссылки

https://github.com/icsharpcode/SharpZipLib/issues/232
Issue Tracking
Patch
Third Party Advisory
https://github.com/icsharpcode/SharpZipLib/wiki/Release-1.0
Issue Tracking
Patch
Third Party Advisory
https://github.com/snyk/zip-slip-vulnerability
Third Party Advisory
https://snyk.io/research/zip-slip-vulnerability
Third Party Advisory
https://snyk.io/vuln/SNYK-DOTNET-SHARPZIPLIB-60247
Exploit
Patch
Technical Description
https://github.com/icsharpcode/SharpZipLib/issues/232
Issue Tracking
Patch
Third Party Advisory
https://github.com/icsharpcode/SharpZipLib/wiki/Release-1.0
Issue Tracking
Patch
Third Party Advisory
https://github.com/snyk/zip-slip-vulnerability
Third Party Advisory
https://snyk.io/research/zip-slip-vulnerability
Third Party Advisory
https://snyk.io/vuln/SNYK-DOTNET-SHARPZIPLIB-60247
Exploit
Patch
Technical Description

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:sharpziplib_project:sharpziplib:*:*:*:*:*:*:*:*

Версия до 0.86.0.518 (включая)

EPSS

Процентиль: 95%

0.10191

Средний

5.5 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-22

Связанные уязвимости

CVE-2018-1002208

CVSS3: 5.5

ubuntu

около 8 лет назад

CVE-2018-1002208

CVSS3: 5.5

debian

около 8 лет назад

SharpZipLib before 1.0 RC1 is vulnerable to directory traversal, allow ...

GHSA-cqj4-m2pc-v9m5

CVSS3: 5.5

github

больше 4 лет назад

Improper Limitation of a Pathname to a Restricted Directory in SharpZipLib

EPSS

Процентиль: 95%

0.10191

Средний

5.5 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-22