VDB

CVE-2022-36943

CVE-2022-36943 PUBLISHED CVSS 8.699999809265137 HIGH

SSZipArchive versions 2.5.3 and older contain an arbitrary file write vulnerability due to lack of sanitization on paths which are symlinks. SSZipArchive will overwrite files on the filesystem when opening a malicious ZIP containing a symlink as the first item.

EPSS 0.92% · 60.0th percentile

Risk Scores

CVSS 4.0
8.699999809265137
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS Score
0.92%
60.0th percentile

Affected Products

VendorProductVersions
ZipArchiveSSZipArchiveunspecified
ziparchive_projectziparchive0

Timeline

  • Jan 3, 2023 CVE Published
  • Jan 4, 2023 EPSS Score
  • Jan 4, 2023 PoC Published
  • Feb 15, 2023 EPSS Score
  • Mar 7, 2023 EPSS Score
  • Mar 29, 2023 EPSS Score
  • May 10, 2023 EPSS Score
  • Jun 21, 2023 EPSS Score
  • Aug 2, 2023 EPSS Score
  • Sep 13, 2023 EPSS Score
  • Oct 25, 2023 EPSS Score
  • Dec 6, 2023 EPSS Score

References

Open in Interactive Console →
$ Console Community · 50/day Open console ›