CVE Feed

    Dashboard / CVE / CVE-2023-22899

    CVE-2023-22899

    Zip4j through 2.11.2, as used in Threema and other products, does not always check the MAC when decrypting a ZIP archive.

    Published:Jan 10, 2023
    Last Modified:Apr 9, 2025
    EPS:Jan 10, 2023
    EPSS Score:0.0016
    CVSS Score:5.9

    Affected Products

    Vendor
    Redhat
    Product
    Migration Toolkit Applications
    Vendor
    Redhat
    Product
    Migration Toolkit Runtimes
    Vendor
    Zip4j Project
    Product
    Zip4j

    Exploits

    https://breakingthe3ma.app/files/Threema-PST22.pdfhttps://github.com/srikanth-lingala/zip4j/issues/485https://breakingthe3ma.app/files/Threema-PST22.pdfhttps://github.com/srikanth-lingala/zip4j/issues/485

    Common Weakness Enumeration

    CWE-346 Origin Validation Error

    Related CVEs

    CVE-2026-11332 (CVSS 7.8) — A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications …
    CVE-2023-6717 (CVSS 6) — A flaw was found in the SAML client registration in Keycloak that could allow an administrator to register mal…
    CVE-2024-1249 (CVSS 7.4) — A flaw was found in Keycloak's OIDC component in the "checkLoginIframe," which allows unvalidated cross-origin…
    CVE-2024-1132 (CVSS 8.1) — A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. This issue coul…
    CVE-2023-45288 (CVSS 7.5) — An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive numb…
    CVE-2024-29180 (CVSS 7.4) — Prior to versions 7.1.0, 6.1.2, and 5.3.4, the webpack-dev-middleware development middleware for devpack does …
    CVE-2024-29133 (CVSS 5.4) — Out-of-bounds Write vulnerability in Apache Commons Configuration.This issue affects Apache Commons Configurat…
    CVE-2024-29131 (CVSS 7.3) — Out-of-bounds Write vulnerability in Apache Commons Configuration.This issue affects Apache Commons Configurat…
    CVE-2024-28849 (CVSS 6.5) — follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatical…
    CVE-2024-24786 (CVSS 7.5) — The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. T…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High