CVE-2022-24254

Опубликовано: 01 мар. 2022

Источник: nvd

CVSS3: 8.8

CVSS2: 6.5

EPSS Низкий

Описание

An unrestricted file upload vulnerability in the Backup/Restore Archive component of Extensis Portfolio v4.0 allows remote attackers to execute arbitrary code via a crafted ZIP file.

Ссылки

http://extensis.com
Product
http://portfolio.com
Not Applicable
https://snyk.io/research/zip-slip-vulnerability
Technical Description
Third Party Advisory
https://www.whiteoaksecurity.com/blog/extensis-portfolio-vulnerability-disclosure/
Exploit
Third Party Advisory
http://extensis.com
Product
http://portfolio.com
Not Applicable
https://snyk.io/research/zip-slip-vulnerability
Technical Description
Third Party Advisory
https://www.whiteoaksecurity.com/blog/extensis-portfolio-vulnerability-disclosure/
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:extensis:portfolio:4.0:*:*:*:*:*:*:*

EPSS

Процентиль: 85%

0.02636

Низкий

8.8 High

CVSS3

6.5 Medium

CVSS2

Дефекты

CWE-434

Связанные уязвимости

GHSA-4rmw-hhg4-fq9w