Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
NA

CVE-2022-48285

Published: 29/01/2023 Updated: 03/03/2023
CVSS v3 Base Score: 7.3 | Impact Score: 3.4 | Exploitability Score: 3.9
VMScore: 0
Subscribe to Jszip Project

Vulnerability Summary

loadAsync in JSZip prior to 3.8.0 allows Directory Traversal via a crafted ZIP archive.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

jszip project jszip

Vendor Advisories

Red Hat:
Description<!---->A flaw was found in the JSZip package Affected versions of JSZip could allow a remote attacker to traverse directories on the system caused by the failure to sanitize filenames when files are loaded with `loadAsync`, which makes the library vulnerable to a Zip Slip attack By extracting files from a specially crafted archive, an ...

References

CWE-22https://github.com/Stuk/jszip/compare/v3.7.1...v3.8.0https://www.mend.io/vulnerability-database/WS-2023-0004https://exchange.xforce.ibmcloud.com/vulnerabilities/244499https://github.com/Stuk/jszip/commit/2edab366119c9ee948357c02f1206c28566cdf15https://nvd.nist.govhttps://access.redhat.com/security/cve/cve-2022-48285
VMScore
CVSSv2
CVSSv3
VMScore
Recommendations:
deserializationCVE-2024-4040cross-site scriptingCVE-2023-25790CVE-2024-2961XML external entityCVE-2024-26926CVE-2024-32806CVE-2024-32711
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook