An issue in Archive v3.3.7 allows attackers to spoof zip filenames which can lead to inconsistent filename parsing.
References
| Link | Resource |
|---|---|
| https://blog.ostorlab.co/zip-packages-exploitation.html | Exploit |
| https://github.com/brendan-duncan/archive/issues/266 | Issue Tracking |
| https://ostorlab.co/vulndb/advisory/OVE-2023-3 | Exploit |
| https://www.rapid7.com/db/modules/exploit/windows/fileformat/winrar_name_spoofing/ | Third Party Advisory |
Configurations
History
01 Oct 2024, 21:35
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-20 |
05 Sep 2023, 19:04
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.8 |
| First Time |
Archive Project
Archive Project archive |
|
| References | (MISC) https://blog.ostorlab.co/zip-packages-exploitation.html - Exploit | |
| References | (MISC) https://github.com/brendan-duncan/archive/issues/266 - Issue Tracking | |
| References | (MISC) https://www.rapid7.com/db/modules/exploit/windows/fileformat/winrar_name_spoofing/ - Third Party Advisory | |
| References | (MISC) https://ostorlab.co/vulndb/advisory/OVE-2023-3 - Exploit | |
| CWE | NVD-CWE-noinfo | |
| CPE | cpe:2.3:a:archive_project:archive:3.3.7:*:*:*:*:*:*:* |
30 Aug 2023, 22:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-08-30 22:15
Updated : 2024-10-01 21:35
NVD link : CVE-2023-39137
Mitre link : CVE-2023-39137
CVE.ORG link : CVE-2023-39137
JSON object : View
Products Affected
archive_project
- archive
CWE