Vulnerability CVE-2021-23484
Published: 2022-01-28

Description:
The package zip-local before 0.3.5 are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) which can lead to an extraction of a crafted file outside the intended extraction directory.

Type:

CWE-668

 (Exposure of Resource to Wrong Sphere)

CVSS2 => (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
7.5/10
6.4/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial
Affected software
Zip-local project -> Zip-local 

 References:
https://github.com/Mostafa-Samir/zip-local/commit/949446a95a660c0752b1db0c654f0fd619ae6085
https://snyk.io/vuln/SNYK-JS-ZIPLOCAL-2327477
https://github.com/Mostafa-Samir/zip-local/blob/master/main.js%23L365
Copyright 2024, cxsecurity.com

 

Back to Top