CVE-2023-39137 : An issue in Archive v3.3.7 allows attackers to spoof zip filenames which can lea

An issue in Archive v3.3.7 allows attackers to spoof zip filenames which can lead to inconsistent filename parsing.

Published 2023-08-30 22:15:09

Updated 2024-10-01 21:35:03

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2023-39137

Archive Project » Archive » Version: 3.3.7
cpe:2.3:a:archive_project:archive:3.3.7:*:*:*:*:*:*:*
Matching versions

EPSS FAQ

0.06%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 26 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
7.8	HIGH	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	1.8	5.9	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Assigned by: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

https://blog.ostorlab.co/zip-packages-exploitation.html

ZIP Exploitation: Critical Vulnerabilities Found in Popular Zip Libraries in Swift and Flutter | Ostorlab: Mobile App Security Testing for Android and iOS
Exploit

CVEs referencing this url
https://github.com/brendan-duncan/archive/issues/266

Archive package is vulnerable to zip filename spoofing · Issue #266 · brendan-duncan/archive · GitHub
Issue Tracking
https://www.rapid7.com/db/modules/exploit/windows/fileformat/winrar_name_spoofing/

WinRAR Filename Spoofing
Third Party Advisory
https://ostorlab.co/vulndb/advisory/OVE-2023-3

Mobile App Security Testing for Android and iOS
Exploit

Jump to