← Retour aux CVEs

CVE-2018-1261

MEDIUM

4.7

Description

Spring-integration-zip versions prior to 1.0.1 exposes an arbitrary file write vulnerability, which can be achieved using a specially crafted zip archive (affects other archives as well, bzip2, tar, xz, war, cpio, 7z) that holds path traversal filenames. So when the filename gets concatenated to the target extraction directory, the final path ends up outside of the target folder.

Details CVE

Score CVSS v3.14.7

SeveriteMEDIUM

Vecteur CVSSCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

Vecteur d'attaqueLOCAL

ComplexiteHIGH

Privileges requisNONE

Interaction utilisateurREQUIRED

Publie5/11/2018

Derniere modification11/21/2024

Sourcenvd

Observations honeypot0

Produits affectes

vmware:spring_integration_zip

Faiblesses (CWE)

CWE-22

References

http://www.securityfocus.com/bid/104178(security_alert@emc.com)

https://pivotal.io/security/cve-2018-1261(security_alert@emc.com)

http://www.securityfocus.com/bid/104178(af854a3a-2127-422b-91ae-364da2661108)

https://pivotal.io/security/cve-2018-1261(af854a3a-2127-422b-91ae-364da2661108)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.