Описание
The decompress package before 4.2.1 for Node.js is vulnerable to Arbitrary File Write via ../ in an archive member, when a symlink is used, because of Directory Traversal.
Ссылки
- ExploitThird Party Advisory
- PatchThird Party Advisory
- Third Party Advisory
- ExploitThird Party Advisory
- PatchThird Party Advisory
- Third Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 4.2.1 (исключая)
cpe:2.3:a:decompress_project:decompress:*:*:*:*:*:node.js:*:*
EPSS
Процентиль: 73%
0.00741
Низкий
9.8 Critical
CVSS3
7.5 High
CVSS2
Дефекты
CWE-22
Связанные уязвимости
EPSS
Процентиль: 73%
0.00741
Низкий
9.8 Critical
CVSS3
7.5 High
CVSS2
Дефекты
CWE-22