CVE-2019-10185CWE-22

It was found that icedtea-web up to and including 1.7.2 and 1.8.2 was vulnerable to a zip-slip attack during auto-extraction of a JAR file

High · published July 31, 2019

CVSS v3.0
8.2
EPSS
4%
Percentile
90.5
In the wild
Unconfirmed
What it is

It was found that icedtea-web up to and including 1.7.2 and 1.8.2 was vulnerable to a zip-slip attack during auto-extraction of a JAR file. An attacker could use this flaw to write files to arbitrary locations. This could also be used to replace the main running application and, possibly, break out of the sandbox.

The record
Technical detail
CVSS v3.0
8.2 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.04022 · 90.5th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2019-07-31T21:50Z
EPSS history
Timeline
  • 31 JUL 21:50Z
    It was found that icedtea-web up to and including 1.7.2 and 1.8.2 was vulnerable to a zip-slip attack during auto-extraction of a JAR file
    cvelistv5