CVE-2021-23391

Arbitrary File Write via Archive Extraction (Zip Slip)

High · published June 7, 2021

CVSS v3.1
7.3
EPSS
0%
Percentile
36.6
In the wild
Unconfirmed
What it is

This affects all versions of package calipso. It is possible for a malicious module to overwrite files on an arbitrary file system through the module install functionality.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L/E:F/RL:U/RC:C
CVSS v4.0
Not supplied
EPSS
0.00433 · 36.6th percentile
Published
2021-06-07T20:40Z
EPSS history
Timeline
  • 07 JUN 20:40Z
    Arbitrary File Write via Archive Extraction (Zip Slip)
    cvelistv5