icon

We found results for “

CVE-2020-28948

Good to know:

icon

Date: November 19, 2020

Archive_Tar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked.

Language: PHP

Severity Score

Related Resources (22)

Severity Score

Weakness Type (CWE)

Deserialization of Untrusted Data

CWE-502

Top Fix

icon

Upgrade Version

Upgrade to version archersys/archersyscloud - no_fix;yetiforce/yetiforce-crm - dev-dependabot/npm_and_yarn/developer/floatthead-2.2.3;yetiforce/yetiforce-crm - dev-depfu/update/composer/zbateson/mail-mime-parser-2.4.0;yetiforce/yetiforce-crm - dev-dependabot/npm_and_yarn/developer/gridstack-3.0.0;yetiforce/yetiforce-crm - dev-dependabot/add-v2-config-file;yetiforce/yetiforce-crm - dev-dependabot/composer/developer/zbateson/mail-mime-parser-2.3.0;yetiforce/yetiforce-crm - dev-dependabot/composer/developer/abraham/twitteroauth-3.1.0;yetiforce/yetiforce-crm - dev-dependabot/npm_and_yarn/developer/chartjs-plugin-datalabels-2.1.0;yetiforce/yetiforce-crm - dev-dependabot/composer/developer/composer/ca-bundle-1.5.0;yetiforce/yetiforce-crm - dev-dependabot/npm_and_yarn/developer/gridstack-3.2.0;xrow/xrowpiwik-ls - 1.3.0;imscp/roundcube - 1.0.0;imscp/roundcube - dev-master;imscp/roundcube - 1.2.x-dev;mpl/matomo - 2.1.0;friendica/friendica - 3.6;vufind/vufind - dev-legacy/bundled-dependencies;vufind/vufind - dev-autocomplete-v2-1-10;vufind/vufind - dev-release-3.0;vufind/vufind - v1.28.0;vufind/vufind - dev-demiankatz-patch-1;vufind/vufind - v1.20.0;vufind/vufind - v1.23.0;vufind/vufind - v2.0beta;vufind/vufind - dev-VUFIND-1342;bpez/infuse - no_fix;bpez/infuse - 1.0.0;bpez/infuse - v5.2.16;redactivemedia/redactive-drupal8-platform - 8.8.0;kitware/cdash - dev-prevent_project_admin_registration;kitware/cdash - v2.6.0;kitware/cdash - dev-ubuntu_base_image;kitware/cdash - trilinos-release-2018-08;whitespace-se/matomo-core - 4.2.x-dev;whitespace-se/matomo-core - 3.12.0;whitespace-se/matomo-core - 3.9.1;piwik/piwik - dev-2.x-dev;piwik/piwik - 2.0.4-b10;piwik/piwik - 2.0.4-b4;piwik/piwik - dev-dependabot-github_actions-ncipollo-release-action-1.14.0;my-oos/my-oos - v2.3.9;my-oos/my-oos - v2.0.113;acquia/acquia_cms - 2020-11-17;acquia/acquia_cms - 2020-10-11;acquia/acquia_cms - 2020-11-05;studio509/project-default - no_fix;matomo/matomo - dev-2.x-dev;matomo/matomo - 2.0.4-b4;matomo/matomo - 2.0.4-b10;matomo/matomo - dev-dependabot-github_actions-ncipollo-release-action-1.14.0;ec-cube/ec-cube - dev-dependabot/composer/twig/twig-2.14.11;pixelstudio/updraftplus - no_fix;pear/archive_tar - 1.4.4;pear/archive_tar - 1.4.11;acosf/archersys - 2.0.0;acosf/archersys - v2.5beta;acosf/archersys - 3.5;acosf/archersys - 4.0.0;acosf/archersys - 1.0;ec-cube2/ec-cube2 - 2.17.0;ec-cube2/ec-cube2 - 2.13.x-dev;birlasoft/drupal-cms - no_fix;x-cart-proj/x-cart-proj - no_fix;imscp/monsta-ftp - no_fix;native-network/example-open-social-composer - no_fix;native-network/example-open-social-composer - dev-dependabot/npm_and_yarn/web/libraries/diff/ini-1.3.7;ravaljigesh/prestolara - no_fix;benborla/xampp - no_fix;unimatrix/backend - 1.0.3;phamvanhieu/laravel_5x - no_fix;adaclare/server-manager - 14;qranio/azure-sdk-pear-deps - no_fix

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): LOCAL
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): REQUIRED
Scope (S): UNCHANGED
Confidentiality (C): HIGH
Integrity (I): HIGH
Availability (A): HIGH

CVSS v2

Base Score:
Access Vector (AV): NETWORK
Access Complexity (AC): MEDIUM
Authentication (AU): NONE
Confidentiality (C): PARTIAL
Integrity (I): PARTIAL
Availability (A): PARTIAL
Additional information:

Do you need more information?

Contact Us