Описание
Grav before 2.0.1 contains a decompression bomb vulnerability in ZipArchiver::extract() that lacks limits on uncompressed size, file count, and nesting depth. Attackers can supply a crafted ZIP archive that expands to fill available disk space, causing denial of service by exhausting storage resources.
EPSS
Процентиль: 16%
0.00249
Низкий
6.5 Medium
CVSS3
Дефекты
CWE-409
Связанные уязвимости
CVSS3: 6.5
github
около 1 месяца назад
Grav before 2.0.1 contains a decompression bomb vulnerability in ZipArchiver::extract() that lacks limits on uncompressed size, file count, and nesting depth. Attackers can supply a crafted ZIP archive that expands to fill available disk space, causing denial of service by exhausting storage resources.
EPSS
Процентиль: 16%
0.00249
Низкий
6.5 Medium
CVSS3
Дефекты
CWE-409