CVE-2022-36943

CVSS 8.1 HIGHEPSS 0.8%CWE-22

Vexday Risk Score

21Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 8.1EPSS 0.8%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

03 jan 2023Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

SSZipArchive versions 2.5.3 and older contain an arbitrary file write vulnerability due to lack of sanitization on paths which are symlinks. SSZipArchive will overwrite files on the filesystem when opening a malicious ZIP containing a symlink as the first item.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H

Produtos afetados

ZipArchive · SSZipArchive

Referências

https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-vgvw-6xcf-qqfc