VDB

CVE-2022-36943

CVE-2022-36943 PUBLISHED CVSS 8.699999809265137 HIGH

SSZipArchive versions 2.5.3 and older contain an arbitrary file write vulnerability due to lack of sanitization on paths which are symlinks. SSZipArchive will overwrite files on the filesystem when opening a malicious ZIP containing a symlink as the first item.

EPSS 0.50% · 66.4th percentile

Risk Scores

CVSS 4.0
8.699999809265137
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS Score
0.50%
66.4th percentile

Affected Products

VendorProductVersions
ZipArchiveSSZipArchiveunspecified
ziparchive_projectziparchive0

Timeline

  • Jan 3, 2023 CVE Published
  • Jan 4, 2023 EPSS Score
  • Jan 4, 2023 PoC Published
  • Feb 14, 2023 EPSS Score
  • Mar 7, 2023 EPSS Score
  • Mar 27, 2023 EPSS Score
  • May 7, 2023 EPSS Score
  • Jun 17, 2023 EPSS Score
  • Jul 29, 2023 EPSS Score
  • Sep 8, 2023 EPSS Score
  • Oct 19, 2023 EPSS Score
  • Nov 29, 2023 EPSS Score

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›