Paper/Archive/CVE-2024-48510

CVE-2024-48510

nuget dotnetzip — Directory Traversal vulnerability in DotNetZip v.1.16.0 and before allows a remote attacker to execute arbitrary code via the src/Zip.Sha…

EPSS 2%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 80.9.809 × 2016.2 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Directory Traversal vulnerability in DotNetZip v.1.16.0 and before allows a remote attacker to execute arbitrary code via the src/Zip.Shared/ZipEntry.Extract.cs component NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Affected

ProductAffectedFixed inSource

n/an/a–CNA

dotnetzipv.1.16.0–CISA-ADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgithub.com/haf/DotNetZip.Semverd/blob/e487179b33a9a0f2631eed5fb04d2c952ea5377a/src/Zip.Shared/ZipEntry.Extract.cs#L1365-L1410 refnuget.org/packages/DotNetZip refgithub.com/haf/DotNetZip.Semverd refgist.github.com/thomas-chauchefoin-bentley-systems/855218959116f870f08857cce2aec731