Back to feed
EUVD-2018-0219 · Published Jul 27, 2018
Arbitrary File Write in adm-zip
Versions of adm-zip before 0.4.9 are vulnerable to arbitrary file write when used to extract a specifically crafted archive that contains path traversal filenames (../../file.txt for example).
Recommendation
Update to version 0.4.9 or later.
Technologies
Adm-Zip_Project Adm-ZipAdm-Zip Adm-Zip
Weaknesses
CWE-22
CVSS scores
- v3.15.5
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
MITRE ATT&CK
InferredWhere this vulnerability fits in an attack
Privilege Escalation
References
Potentially impacted assets
See if this affects your attack surface
