CVE-2022-26049

2022-09-1114:15:08

CWE-22

[email protected]

web.nvd.nist.gov

cve-2022-26049

security vulnerability

remote code execution

com.diffplug.gradle:goomph

nvd

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.9 High

AI Score

Confidence

High

0.009 Low

EPSS

Percentile

82.8%

JSON

This affects the package com.diffplug.gradle:goomph before 3.37.2. It allows a malicious zip file to potentially break out of the expected destination directory, writing contents into arbitrary locations on the file system. Overwriting certain files/directories could allow an attacker to achieve remote code execution on a target system by exploiting this vulnerability. Note: This could have allowed a malicious zip file to extract itself into an arbitrary directory. The only file that Goomph extracts is the p2 bootstrapper and eclipse metadata files hosted at eclipse.org, which are not malicious, so the only way this vulnerability could have affected you is if you had set a custom bootstrap zip, and that zip was malicious.

Affected configurations

NVD

Node

diffpluggoomphRange<3.37.2

CPENameOperatorVersion
diffplug:goomphdiffplug goomphlt3.37.2

CPE	Name	Operator	Version
diffplug:goomph	diffplug goomph	lt	3.37.2

CNA Affected

[
  {
    "product": "com.diffplug.gradle:goomph",
    "vendor": "n/a",
    "versions": [
      {
        "lessThan": "3.37.2",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]