PT-2024-14847 · Arc · Arc

Gabriele Quagliarella · Published 2024-05-15 · Updated 2024-05-28 · CVE-2023-5938

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Arc (affected versions not specified)

Description The issue arises from multiple functions using archives without properly validating the filenames, making the application susceptible to path traversal via 'zip slip' attacks. An administrator who can provide tampered archives for processing by the affected Arc versions may be able to extract arbitrary files to arbitrary filesystem locations. This could allow an attacker to overwrite arbitrary files on the target filesystem, potentially leading to critical system impacts, such as arbitrary command execution on the victim's machine.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2023-5938

Affected Products

Arc

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2023-5938 · Security Note
• https://t.me/cvenotify/79884 · Telegram Post
• https://security.nozominetworks.com/NN-2023:16-01 · Note
• https://t.me/cvenotify/81162 · Telegram Post