PT-2023-32802 · Peazip · Peazip

Tfhm · Published 2023-12-17 · Updated 2024-05-17 · CVE-2023-6891

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PeaZip versions 9.4.0

Description A vulnerability has been found in the library dragdropfilesdll.dll of the component Library Handler, leading to uncontrolled search path. The manipulation can be exploited locally. Upgrading to version 9.6.0 is able to address this issue.

Recommendations For PeaZip version 9.4.0, upgrade to version 9.6.0 to address the issue. As a temporary workaround, consider restricting access to the dragdropfilesdll.dll library until the update is applied.

Fix

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

CVE-2023-6891

Affected Products

Peazip

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-6891 · Security Note
• https://peazip.github.io/changelog.html · Patch
• https://osv.dev/vulnerability/CVE-2023-6891 · Vendor Advisory
• https://vuldb.com/?id.248251 · Note
• https://vuldb.com/?ctiid.248251 · Note
• https://t.me/cvenotify/63901 · Telegram Post