PT-2023-8523 · Cpio · Cpio

Febin Mon Saji · Publicado 2023-11-15 · Atualizado 2026-02-25 · CVE-2023-7216

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions cpio (affected versions not specified)

Description A path traversal vulnerability was found in the CPIO utility. This issue could allow a remote unauthenticated attacker to trick a user into opening a specially crafted archive. During the extraction process, the archiver could follow symlinks outside of the intended directory, which allows files to be written in arbitrary directories through symlinks. The vulnerability is related to incorrect link resolution before accessing a file, which may enable an attacker to execute arbitrary commands.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Link Following

Path traversal

Enumeração de Fraquezas

CWE-59

CWE-22

Identificadores relacionados

BDU:2024-01091

CVE-2023-7216

Produtos afetados

Cpio

Referências · 26

• 🔥 https://bugzilla.redhat.com/show_bug.cgi?id=2249901 · Exploit
• https://ubuntu.com/security/CVE-2023-7216 · Aviso do Fabricante
• https://twitter.com/fridaysecurity/status/1755070021619835344 · Publicação no Twitter
• https://twitter.com/Dinosn/status/1755076458924429417 · Publicação no Twitter
• https://t.me/cvenotify/71159 · Publicação no Telegram
• https://twitter.com/xBWothnDrdZsUl2/status/1754852949082485111 · Publicação no Twitter
• https://t.me/cvenotify/82985 · Publicação no Telegram
• https://cve.org/CVERecord?id=CVE-2023-7216 · Nota de Segurança
• https://t.me/cveNotify/153231 · Publicação no Telegram
• https://access.redhat.com/security/cve/CVE-2023-7216 · Nota
• https://t.me/cvenotify/79704 · Publicação no Telegram
• https://t.me/cvenotify/93865 · Publicação no Telegram
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-7216 · Aviso do Fabricante
• https://t.me/cvenotify/71900 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/1754560353654931824 · Publicação no Twitter