1. Home
  2. Vulnerabilities
  3. CVE-2018-1263

CVE-2018-1263

CVSS v3.1 4.7 (Medium)
47% Progress
CVSS v2.0 4 (Medium)
40% Progress
EPSS 0.05 % (21th)
0.05% Progress
Affected Products 1
Advisories 1
Info CVSS EPSS CAPEC Affected Configurations References Security Advisories Packages & Software Tools, Exploits & PoC Graph Web & Social Timeline

Addresses partial fix in CVE-2018-1261. Pivotal spring-integration-zip, versions prior to 1.0.2, exposes an arbitrary file write vulnerability, that can be achieved using a specially crafted zip archive (affects other archives as well, bzip2, tar, xz, war, cpio, 7z), that holds path traversal filenames. So when the filename gets concatenated to the target extraction directory, the final path ends up outside of the target folder.

Weaknesses
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Related CVEs
CVE Status
PUBLISHED
CNA
Dell
Published Date
2018-05-15 20:29:00
(6 years ago)
Updated Date
2021-08-12 21:31:15
(3 years ago)

Affected Products

Vmware

Configuration #1

    CPE23 From Up To
  Vmware Spring Integration Zip prior 1.0.2 version cpe:2.3:a:vmware:spring_integration_zip < 1.0.2