Published: 25/07/2018 Updated: 02/08/2023

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

CVSS v3 Base Score: 5.5 | Impact Score: 3.6 | Exploitability Score: 1.8

VMScore: 383

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

plexus-archiver prior to 3.6.0 is vulnerable to directory traversal, allowing malicious users to write to arbitrary files via a ../ (dot dot slash) in an archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.

Vulnerable Product	Search on Vulmon	Subscribe to Product
codehaus-plexus plexus-archiver
redhat enterprise linux desktop 7.0
redhat enterprise linux workstation 7.0
debian debian linux 8.0
debian debian linux 9.0
redhat enterprise linux 7.5

Synopsis Important: plexus-archiver security update Type/Severity Security Advisory: Important Topic An update for plexus-archiver is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (C ...

Synopsis Important: rh-maven33-plexus-archiver and rh-maven35-plexus-archiver security update Type/Severity Security Advisory: Important Topic An update for rh-maven33-plexus-archiver and rh-maven35-plexus-archiver is now available for Red Hat Software CollectionsRed Hat Product Security has rated this upd ...

Debian Bug report logs - #900953 plexus-archiver: CVE-2018-1002200 Package: src:plexus-archiver; Maintainer for src:plexus-archiver is Debian Java Maintainers <pkg-java-maintainers@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Thu, 7 Jun 2018 09:27:02 UTC Severity: grave Tags: ...

Danny Grander discovered a directory traversal flaw in plexus-archiver, an Archiver plugin for the Plexus compiler system, allowing an attacker to overwrite any file writable by the extracting user via a specially crafted Zip archive For the oldstable distribution (jessie), this problem has been fixed in version 12-1+deb8u1 For the stable distri ...

A path traversal vulnerability has been discovered in plexus-archiver when extracting a carefully crafted zip file which holds path traversal file names A remote attacker could use this vulnerability to write files outside the target directory and overwrite existing files with malicious code or vulnerable configurations(CVE-2018-1002200) ...

A path traversal vulnerability has been discovered in plexus-archiver when extracting a carefully crafted zip file which holds path traversal file names A remote attacker could use this vulnerability to write files outside the target directory and overwrite existing files with malicious code or vulnerable configurations ...

This is a fork of "Maven External Dependency Plugin", http://code.google.com/p/maven-external-dependency-plugin/. This Maven plugin allows downloading, installing, and deploying dependency artifacts that are not stored in a Maven repository.

No longer maintained This plugin is no longer maintained, and is vulnerable to potential abuse as a result of not updating dependencies At the time of writing, CVE-2018-1002200 is one such example External Dependency Maven Plugin This Maven plugin can be used to manage external dependencies that are not available in public Maven repositories or not mavenized at all The plugi

CWE-22 https://snyk.io/vuln/SNYK-JAVA-ORGCODEHAUSPLEXUS-31680 https://snyk.io/research/zip-slip-vulnerability https://github.com/snyk/zip-slip-vulnerability https://github.com/codehaus-plexus/plexus-archiver/pull/87 https://github.com/codehaus-plexus/plexus-archiver/commit/f8f4233508193b70df33759ae9dc6154d69c2ea8 https://www.debian.org/security/2018/dsa-4227 https://access.redhat.com/errata/RHSA-2018:1837 https://access.redhat.com/errata/RHSA-2018:1836 https://access.redhat.com/errata/RHSA-2018:1836 https://nvd.nist.gov https://github.com/Nadahar/external-maven-plugin https://www.debian.org/security/./dsa-4227

CVE-2018-1002200

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect