PT-2022-6761 · Jszip+1 · Jszip+1

Mccaulay Hudson · Published 2022-03-30 · Updated 2024-08-01 · CVE-2022-48285

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions JSZip versions prior to 3.8.0

Description The issue is related to the loadAsync function in JSZip, which allows directory traversal via a crafted ZIP archive. This can be exploited by a remote attacker to write arbitrary files and execute arbitrary commands using a specially crafted malicious ZIP archive.

Recommendations For versions prior to 3.8.0, update to version 3.8.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of the loadAsync function until a patch is available. Avoid using the loadAsync function with untrusted ZIP archives until the issue is resolved.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

AZL-38236

AZL-57076

BDU:2023-04192

CVE-2022-48285

GHSA-36FH-84J7-CV5H

Affected Products

Debian

Jszip

References · 20

• https://github.com/Stuk/jszip/commit/2edab366119c9ee948357c02f1206c28566cdf15 · Patch
• https://osv.dev/vulnerability/GHSA-36fh-84j7-cv5h · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-48285 · Security Note
• https://osv.dev/vulnerability/CVE-2022-48285 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-48285 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-38236 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-48285 · Security Note
• https://ubuntu.com/security/CVE-2022-48285 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-48285 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-04192 · Security Note
• https://osv.dev/vulnerability/AZL-57076 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-48285 · Vendor Advisory
• https://github.com/Stuk/jszip/compare/v3.7.1...v3.8.0 · Note
• https://github.com/Stuk/jszip · Note
• https://altsp.su/obnovleniya-bezopasnosti · Note