In all versions of the package github.com/unknwon/cae/tz, the ExtractTo function doesn't securely escape file paths in zip archives which include leading or non-leading "..". This allows an attacker to add or replace files system-wide.
References
| Link | Resource |
|---|---|
| https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMUNKNWONCAETZ-570384 | Exploit Third Party Advisory |
| https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMUNKNWONCAETZ-570384 | Exploit Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 05:37
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMUNKNWONCAETZ-570384 - Exploit, Third Party Advisory |
01 Jan 2022, 17:34
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:compression_and_archive_extensions_tz_project:compression_and_archive_extensions_tz_project:*:*:*:*:*:*:*:* |
21 Dec 2021, 01:01
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-22 | |
| CPE | cpe:2.3:a:compression_and_archive_extensions_project:compression_and_archive_extensions_project:*:*:*:*:*:*:*:* |
Information
Published : 2020-06-23 19:38
Updated : 2024-11-21 05:37
NVD link : CVE-2020-7668
Mitre link : CVE-2020-7668
CVE.ORG link : CVE-2020-7668
JSON object : View
Products Affected
compression_and_archive_extensions_tz_project
- compression_and_archive_extensions_tz_project
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')