GHSA-hcwx-7q5v-vc67

    Dashboard / Vulnerabilities / GHSA-hcwx-7q5v-vc67

    GHSA-hcwx-7q5v-vc67

    Published: 14 May 2022Last Modified: 8 Nov 2023

    Summary: Path Traversal in OWASP Dependency-Check

    Details: OWASP Dependency-Check before 3.2.0 allows attackers to write to arbitrary files via a crafted archive that holds directory traversal filenames.

    References: https://nvd.nist.gov/vuln/detail/CVE-2018-12036, https://github.com/jeremylong/DependencyCheck, https://github.com/jeremylong/DependencyCheck/blob/master/RELEASE_NOTES.md#version-320-2018-05-21, https://github.com/snyk/zip-slip-vulnerability

    Affected packages

    Package

    Name: org.owasp:dependency-check-maven

    Purl: pkg:maven/org.owasp/dependency-check-maven

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -3.2.0

    Affected versions

    1.0.0
    1.0.1
    1.0.2
    1.0.3
    1.0.4
    1.0.5
    1.0.6
    1.0.7
    1.0.8

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High