PT-2023-32802 · Peazip · Peazip

Tfhm · CVE-2023-6891 · Published 2023-12-17 · Updated 2024-05-17

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions PeaZip versions 9.4.0

Description A vulnerability has been found in the library dragdropfilesdll.dll of the component Library Handler, leading to uncontrolled search path. The manipulation can be exploited locally. Upgrading to version 9.6.0 is able to address this issue.

Recommendations For PeaZip version 9.4.0, upgrade to version 9.6.0 to address the issue. As a temporary workaround, consider restricting access to the dragdropfilesdll.dll library until the update is applied.

Exploit

Fix

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

CVE-2023-6891

Affected Products

Peazip

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/6xxx/CVE-2023-6891.json · Exploit
• https://osv.dev/vulnerability/CVE-2023-6891 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-6891 · Security Note
• https://peazip.github.io/changelog.html · Patch
• https://t.me/cvenotify/63901 · Telegram Post
• https://vuldb.com/?ctiid.248251 · Note
• https://vuldb.com/?id.248251 · Note