CVE-2021-43099

An Archive Extraction (AKA "Zip Slip) vulnerability exists in bbs 5.3 in the UpgradeNow function in UpgradeManageAction.java, which unzips the arbitrary…

published March 28, 2022

CVSS
—
EPSS
1%
Percentile
65.6
In the wild
Unconfirmed
What it is

An Archive Extraction (AKA "Zip Slip) vulnerability exists in bbs 5.3 in the UpgradeNow function in UpgradeManageAction.java, which unzips the arbitrary upladed zip file without checking filenames. The vulnerability is exploited using a specially crafted archive that holds directory traversal filenames (e.g. ../../evil.exe).

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01109 · 65.6th percentile
Published
2022-03-28T21:16Z
EPSS history
Timeline
  • 28 MAR 21:16Z
    An Archive Extraction (AKA "Zip Slip) vulnerability exists in bbs 5.3 in the UpgradeNow function in UpgradeManageAction.java, which unzips the arbitrary…
    cvelistv5