search

pferron / Case130339

0 stars 0 forks source link

dotnetzip.1.16.0.nupkg: 1 vulnerabilities (highest severity is: 9.1) #6

Open mend-for-github-com[bot] opened 2 weeks ago

mend-for-github-com[bot] commented 2 weeks ago
Vulnerable Library - dotnetzip.1.16.0.nupkg

A library for dealing with zip, bzip and zlib from .Net

Library home page: https://api.nuget.org/packages/dotnetzip.1.16.0.nupkg

Path to dependency file: /Website/CloudAdmin/CloudAdmin.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/dotnetzip/1.16.0/dotnetzip.1.16.0.nupkg

Found in HEAD commit: d503d8971b44834026d34941936134cff6b7de15

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (dotnetzip.1.16.0.nupkg version) Remediation Possible**
CVE-2024-48510 Critical 9.1 dotnetzip.1.16.0.nupkg Direct N/A ❌

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2024-48510 ### Vulnerable Library - dotnetzip.1.16.0.nupkg

A library for dealing with zip, bzip and zlib from .Net

Library home page: https://api.nuget.org/packages/dotnetzip.1.16.0.nupkg

Path to dependency file: /Website/CloudAdmin/CloudAdmin.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/dotnetzip/1.16.0/dotnetzip.1.16.0.nupkg

Dependency Hierarchy: - :x: **dotnetzip.1.16.0.nupkg** (Vulnerable Library)

Found in HEAD commit: d503d8971b44834026d34941936134cff6b7de15

Found in base branch: main

### Vulnerability Details

Directory Traversal vulnerability in DotNetZip v.1.16.0 and before allows a remote attacker to execute arbitrary code via the src/Zip.Shared/ZipEntry.Extract.cs component NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Publish Date: 2024-11-13

URL: CVE-2024-48510

### CVSS 3 Score Details (9.1)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: None

For more information on CVSS3 Scores, click here.