PT-2021-10850 · Kuba · Kuba

Jiahao42 · Published 2021-08-10 · Updated 2021-08-17 · CVE-2020-23172

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Kuba versions all

Description A vulnerability allows attackers to overwrite arbitrary files in arbitrary directories with crafted Zip files due to improper validation of file paths in .zip archives.

Recommendations For all versions, consider restricting the handling of .zip archives until a proper fix is applied, and ensure that file paths are properly validated to prevent arbitrary file overwrites.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2020-23172

Affected Products

Kuba

References · 4

• 🔥 https://github.com/kuba--/zip/issues/123 · Exploit
• https://osv.dev/vulnerability/CVE-2020-23172 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-23172 · Security Note
• https://t.me/cibsecurity/27087 · Telegram Post