PT-2007-3299 · Archivexpert · Archivexpert

Publicado 2007-04-11 · Atualizado 2017-07-29 · CVE-2007-1954

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ArchiveXpert version 2.02 build 80

Description The issue allows remote attackers to create files in arbitrary directories via a .. (dot dot) in various archive file types, including .gz, .jar, .rar, .tar.gz, .zip, and .tar files.

Recommendations For ArchiveXpert version 2.02 build 80, consider restricting the ability to upload or process archive files until a patch is available. As a temporary workaround, limit access to sensitive directories to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2007-1954

Produtos afetados

Archivexpert

Referências · 6

• http://bugtraq.ir/articles/advisory/archivexpert_directory_traversal/8 · Nota
• http://vupen.com/english/advisories/2007/1311 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/33539 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-1954 · Nota de Segurança
• http://securityfocus.com/bid/23372 · Nota
• http://secunia.com/advisories/24827 · Aviso do Fabricante