Vulnerability CVE-2022-30333
Published: 2022-05-09

Description:
RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonstrated by creating a ~/.ssh/authorized_keys file. NOTE: WinRAR and Android RAR are unaffected.

See advisories in our WLB2 database:
Topic
Author
Date
High
Zimbra UnRAR Path Traversal
Ron Bowes
08.08.2022

Type:

CWE-22

 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))

CVSS2 => (AV:N/AC:L/Au:N/C:N/I:P/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
5/10
2.9/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
None
Partial
None

 References:
https://www.rarlab.com/rar/rarlinux-x32-612.tar.gz
https://www.rarlab.com/rar_add.htm
Copyright 2024, cxsecurity.com

 

Back to Top