CVE-2020-36560

  1. Reconshell
  2. Vulnerabilities (CVE)
  3. CVE-2020-36560
Due to improper path santization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory.

9.1 /10

CVSS v3.0 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/artdarek/go-unzip/pull/2 Exploit Third Party Advisory
https://pkg.go.dev/vuln/GO-2020-0034 Third Party Advisory
https://snyk.io/research/zip-slip-vulnerability Technical Description Third Party Advisory
https://github.com/artdarek/go-unzip/commit/4975cbe0a719dc50b12da8585f1f207c82f7dfe0 Patch Third Party Advisory
Advertisement

NeevaHost hosting service
Configurations

Configuration 1 (hide)

cpe:2.3:a:go-unzip_project:go-unzip:*:*:*:*:*:go:*:*
Information

Published : 2022-12-27 14:15

Updated : 2023-01-05 17:26

NVD link : CVE-2020-36560

Mitre link : CVE-2020-36560

JSON object : View

CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Advertisement

dedicated server usa
Products Affected

go-unzip_project

  • go-unzip