CVE-2022-36943

CVSS 8.1 HIGHEPSS 0.8%CWE-22

Vexday Risk Score

21Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 8.1EPSS 0.8%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

03 Jan 2023Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

SSZipArchive versions 2.5.3 and older contain an arbitrary file write vulnerability due to lack of sanitization on paths which are symlinks. SSZipArchive will overwrite files on the filesystem when opening a malicious ZIP containing a symlink as the first item.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Affected products

ZipArchive · SSZipArchive

References

https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-vgvw-6xcf-qqfc