CVE-2023-2621CWE-22

The McFeeder server (distributed as part of SSW package), is susceptible to an arbitrary file write vulnerability on the MAIN computer system

Medium · published November 1, 2023

CVSS v3.1
6.5
EPSS
0%
Percentile
41.0
In the wild
Unconfirmed
What it is

The McFeeder server (distributed as part of SSW package), is susceptible to an arbitrary file write vulnerability on the MAIN computer

system. This vulnerability stems from the use of an outdated version of a third-party library, which is used to extract archives uploaded to McFeeder server. An authenticated malicious client can

exploit this vulnerability by uploading a crafted ZIP archive via the

network to McFeeder’s service endpoint.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00486 · 41.0th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2023-11-01T02:10Z
EPSS history
Timeline
  • 01 NOV 02:10Z
    The McFeeder server (distributed as part of SSW package), is susceptible to an arbitrary file write vulnerability on the MAIN computer system
    cvelistv5