CVE-2022-36943
Assigner: facebook
Published: 2023-01-03T00:00:00
State: PUBLISHED
dateAssigned: 2022-06-30T00:00:00
descriptions: value: SSZipArchive versions 2.5.3 and older contain an arbitrary file write vulnerability due to lack of sanitization on paths which are symlinks. SSZipArchive will overwrite files on the filesystem when opening a malicious ZIP containing a symlink as the first item.
affected: vendor: ZipArchive
product: SSZipArchive
versions: version: unspecified
lessThanOrEqual: 2.5.3
status: affected
versionType: custom
problemTypes: descriptions: type: CWE
description: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), CWE-61: UNIX Symbolic Link (Symlink) Following
cweId: CWE-22