CVE-2019-16511

{"id": "CVE-2019-16511", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2019-09-19T16:15:11.777", "references": [{"url": "https://github.com/GitHubAssessments/CVE_Assessments_09_2019", "source": "cve@mitre.org"}, {"url": "https://github.com/wixtoolset/issues/issues/6075", "tags": ["Patch", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://wixtoolset.org/development/wips/6075-dtf-zip-slip/", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.firegiant.com/blog/2019/9/18/wix-v3.11.2-released/", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/GitHubAssessments/CVE_Assessments_09_2019", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/wixtoolset/issues/issues/6075", "tags": ["Patch", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://wixtoolset.org/development/wips/6075-dtf-zip-slip/", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.firegiant.com/blog/2019/9/18/wix-v3.11.2-released/", "tags": ["Patch", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in DTF in FireGiant WiX Toolset before 3.11.2. Microsoft.Deployment.Compression.Cab.dll and Microsoft.Deployment.Compression.Zip.dll allow directory traversal during CAB or ZIP archive extraction, because the full name of an archive file (even with a ../ sequence) is concatenated with the destination path."}, {"lang": "es", "value": "Se detect\u00f3 un problema en DTF en FireGiant WiX Toolset versiones anteriores a 3.11.2. Las bibliotecas Microsoft.Deployment.Compression.Cab.dll y Microsoft.Deployment.Compression.Zip.dll, permiten un salto de directorio durante la extracci\u00f3n de archivos CAB o ZIP, porque el nombre completo de un archivo (incluso con una secuencia ../) se concatena con la ruta de destino."}], "lastModified": "2024-11-21T04:30:43.880", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:firegiant:wix_toolset:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ED50D663-0FAF-46D1-827C-A1D32AEFC98B", "versionEndExcluding": "3.11.2"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}