Veille CVE
CVE-2022-30333
7.5 Élevée Exploitée activement Utilisée par des rançongicielsCatalogue CISA KEV — RARLAB UnRAR Directory Traversal Vulnerability
Ajoutée le 09/08/2022 · Échéance de correction (agences US) : 30/08/2022
Action requise : Apply updates per vendor instructions.
Description
RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonstrated by creating a ~/.ssh/authorized_keys file. NOTE: WinRAR and Android RAR are unaffected.
Produits concernés
Scores CVSS
| Version | Score | Source | Vecteur |
|---|---|---|---|
| 3.1 | 7.5 Élevée | nvd@nist.gov (NVD) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
| 3.1 | 9.8 Critique | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 2.0 | 5.0 Moyenne | nvd@nist.gov (NVD) | AV:N/AC:L/Au:N/C:N/I:P/A:N |
Faiblesses (CWE)
Références
- http://packetstormsecurity.com/files/167989/Zimbra-UnRAR-Path-Traversal.html ExploitThird Party AdvisoryVDB Entry
- https://blog.sonarsource.com/zimbra-pre-auth-rce-via-unrar-0day/ ExploitThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/08/msg00022.html Mailing ListThird Party Advisory
- https://security.gentoo.org/glsa/202309-04 Third Party Advisory
- https://www.rarlab.com/rar/rarlinux-x32-612.tar.gz Patch
- https://www.rarlab.com/rar_add.htm Product
- http://packetstormsecurity.com/files/167989/Zimbra-UnRAR-Path-Traversal.html ExploitThird Party AdvisoryVDB Entry
- https://blog.sonarsource.com/zimbra-pre-auth-rce-via-unrar-0day/ ExploitThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/08/msg00022.html Mailing ListThird Party Advisory
- https://security.gentoo.org/glsa/202309-04 Third Party Advisory
- https://www.rarlab.com/rar/rarlinux-x32-612.tar.gz Patch
- https://www.rarlab.com/rar_add.htm Product
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-30333 US Government Resource