Lucene search

SnykCVE-2020-7664

HistoryJun 23, 2020 - 7:38 p.m.

CVE-2020-7664

2020-06-2319:38:14

CWE-22

snyk

web.nvd.nist.gov

cve-2020-7664

software vulnerability

github.com

zip package

file path handling

security issue

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS

0.001

Percentile

43.5%

JSON

In all versions of the package github.com/unknwon/cae/zip, the ExtractTo function doesn’t securely escape file paths in zip archives which include leading or non-leading “…”. This allows an attacker to add or replace files system-wide.

Affected configurations

Nvd

Node

compression_and_archive_extensions_projectcompression_and_archive_extensions_zip_project

VendorProductVersionCPE
compression_and_archive_extensions_projectcompression_and_archive_extensions_zip_project*cpe:2.3:a:compression_and_archive_extensions_project:compression_and_archive_extensions_zip_project:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
compression_and_archive_extensions_project	compression_and_archive_extensions_zip_project	*	cpe:2.3:a:compression_and_archive_extensions_project:compression_and_archive_extensions_zip_project::::::::

CNA Affected

[
  {
    "product": "github.com/unknwon/cae/zip",
    "vendor": "n/a",
    "versions": [
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

References

snyk.io/vuln/SNYK-GOLANG-GITHUBCOMUNKNWONCAEZIP-570383

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS

0.001

Percentile

43.5%

JSON

Related for CVE-2020-7664