[20220301] - Core - Zip Slip within the Tar extractor

CVE-2022-23793

7.5HIGH

Key Information

Vendor: Joomla
Status: Joomla! Cms; Joomla/archive
Vendor: CVE Published:; 30 March 2022

Summary

An issue was discovered in Joomla! 3.0.0 through 3.10.6 & 4.0.0 through 4.1.0. Extracting an specifilcy crafted tar package could write files outside of the intended path.

Affected Version(s)

Joomla! CMS = 3.0.0-3.10.6 & 4.0.0-4.1.0

joomla/archive = 1.0.0-1.1.11 & 2.0.0

CVSS V3.1

Score:

7.5

Severity:

HIGH

Confidentiality:

None

Integrity:

High

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Timeline

Vulnerability published.
Mar 30, 2022
Vulnerability Reserved.
Jan 20, 2022

Collectors

NVD DatabaseMitre Database