exploitDog

CVE-2023-39137

Опубликовано: 30 авг. 2023

Источник: nvd

CVSS3: 7.8

EPSS Низкий

Описание

An issue in Archive v3.3.7 allows attackers to spoof zip filenames which can lead to inconsistent filename parsing.

Ссылки

https://blog.ostorlab.co/zip-packages-exploitation.html
Exploit
https://github.com/brendan-duncan/archive/issues/266
Issue Tracking
https://ostorlab.co/vulndb/advisory/OVE-2023-3
Exploit
https://www.rapid7.com/db/modules/exploit/windows/fileformat/winrar_name_spoofing/
Third Party Advisory
https://blog.ostorlab.co/zip-packages-exploitation.html
Exploit
https://github.com/brendan-duncan/archive/issues/266
Issue Tracking
https://ostorlab.co/vulndb/advisory/OVE-2023-3
Exploit
https://www.rapid7.com/db/modules/exploit/windows/fileformat/winrar_name_spoofing/
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:archive_project:archive:3.3.7:*:*:*:*:*:*:*

EPSS

Процентиль: 13%

0.00043

Низкий

7.8 High

CVSS3

Дефекты

NVD-CWE-noinfo

CWE-20

Связанные уязвимости

GHSA-r285-q736-9v95

CVSS3: 7.8

github

больше 2 лет назад

Filename spoofing in archive

EPSS

Процентиль: 13%

0.00043

Низкий

7.8 High

CVSS3

Дефекты

NVD-CWE-noinfo

CWE-20