Описание
The package-decompression feature in HL7 (Health Level 7) FHIR Core Libraries before 5.6.106 allows attackers to copy arbitrary files to certain directories via directory traversal, if an allowed directory name is a substring of the directory name chosen by the attacker. NOTE: this issue exists because of an incomplete fix for CVE-2023-24057.
Ссылки
- Third Party Advisory
- Not Applicable
- Broken Link
- Third Party Advisory
- Not Applicable
- Broken Link
Уязвимые конфигурации
Конфигурация 1Версия до 5.6.106 (исключая)
cpe:2.3:a:hapifhir:hl7_fhir_core:*:*:*:*:*:*:*:*
EPSS
Процентиль: 67%
0.0055
Низкий
7.5 High
CVSS3
Дефекты
CWE-22
CWE-22
Связанные уязвимости
CVSS3: 7.5
github
почти 3 года назад
HL7 FHIR Partial Path Zip Slip due to bypass of CVE-2023-24057
EPSS
Процентиль: 67%
0.0055
Низкий
7.5 High
CVSS3
Дефекты
CWE-22
CWE-22