
We found results for “”
CVE-2020-28949
Good to know:

Date: November 19, 2020
Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite files) can still succeed.
Language: PHP
Severity Score
Related Resources (24)
Severity Score
Weakness Type (CWE)
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE-74Top Fix

Upgrade Version
Upgrade to version pear/archive_tar - 1.4.4;pear/archive_tar - 1.4.11;bpez/infuse - v5.2.16;bpez/infuse - no_fix;bpez/infuse - 1.0.0;whitespace-se/matomo-core - 3.9.1;whitespace-se/matomo-core - 3.12.0;whitespace-se/matomo-core - 4.2.x-dev;yetiforce/yetiforce-crm - dev-dependabot/npm_and_yarn/developer/chartjs-plugin-datalabels-2.1.0;yetiforce/yetiforce-crm - dev-dependabot/composer/developer/zbateson/mail-mime-parser-2.3.0;yetiforce/yetiforce-crm - dev-dependabot/composer/developer/abraham/twitteroauth-3.1.0;yetiforce/yetiforce-crm - dev-dependabot/add-v2-config-file;yetiforce/yetiforce-crm - dev-dependabot/npm_and_yarn/developer/floatthead-2.2.3;yetiforce/yetiforce-crm - dev-depfu/update/composer/zbateson/mail-mime-parser-2.4.0;yetiforce/yetiforce-crm - dev-dependabot/npm_and_yarn/developer/gridstack-3.0.0;yetiforce/yetiforce-crm - dev-dependabot/npm_and_yarn/developer/gridstack-3.2.0;yetiforce/yetiforce-crm - dev-dependabot/composer/developer/composer/ca-bundle-1.5.0;birlasoft/drupal-cms - no_fix;phamvanhieu/laravel_5x - no_fix;acquia/acquia_cms - 2020-11-05;acquia/acquia_cms - 2020-10-11;acquia/acquia_cms - 2020-11-17;vufind/vufind - dev-autocomplete-v2-1-10;vufind/vufind - dev-VUFIND-1342;vufind/vufind - dev-demiankatz-patch-1;vufind/vufind - v1.20.0;vufind/vufind - dev-legacy/bundled-dependencies;vufind/vufind - dev-release-3.0;vufind/vufind - v1.28.0;vufind/vufind - v2.0beta;vufind/vufind - v1.23.0;imscp/roundcube - 1.2.x-dev;imscp/roundcube - dev-master;imscp/roundcube - 1.0.0;acosf/archersys - v2.5beta;acosf/archersys - 2.0.0;acosf/archersys - 3.5;acosf/archersys - 4.0.0;acosf/archersys - 1.0;x-cart-proj/x-cart-proj - no_fix;kitware/cdash - v2.6.0;kitware/cdash - dev-ubuntu_base_image;kitware/cdash - dev-prevent_project_admin_registration;kitware/cdash - trilinos-release-2018-08;studio509/project-default - no_fix;friendica/friendica - 3.6;piwik/piwik - dev-dependabot-github_actions-ncipollo-release-action-1.14.0;piwik/piwik - 2.0.4-b10;piwik/piwik - 2.0.4-b4;piwik/piwik - dev-2.x-dev;matomo/matomo - 2.0.4-b10;matomo/matomo - dev-2.x-dev;matomo/matomo - 2.0.4-b4;matomo/matomo - dev-dependabot-github_actions-ncipollo-release-action-1.14.0;ec-cube/ec-cube - dev-dependabot/composer/twig/twig-2.14.11;native-network/example-open-social-composer - dev-dependabot/npm_and_yarn/web/libraries/diff/ini-1.3.7;native-network/example-open-social-composer - no_fix;adaclare/server-manager - 14;mpl/matomo - 2.1.0;ec-cube2/ec-cube2 - 2.17.0;ec-cube2/ec-cube2 - 2.13.x-dev;archersys/archersyscloud - no_fix;redactivemedia/redactive-drupal8-platform - 8.8.0;my-oos/my-oos - v2.0.113;my-oos/my-oos - v2.3.9;pixelstudio/updraftplus - no_fix;benborla/xampp - no_fix;xrow/xrowpiwik-ls - 1.3.0;imscp/monsta-ftp - no_fix;ravaljigesh/prestolara - no_fix;qranio/azure-sdk-pear-deps - no_fix;unimatrix/backend - 1.0.3
CVSS v3.1
Base Score: |
|
---|---|
Attack Vector (AV): | LOCAL |
Attack Complexity (AC): | LOW |
Privileges Required (PR): | NONE |
User Interaction (UI): | REQUIRED |
Scope (S): | UNCHANGED |
Confidentiality (C): | HIGH |
Integrity (I): | HIGH |
Availability (A): | HIGH |
CVSS v2
Base Score: |
|
---|---|
Access Vector (AV): | NETWORK |
Access Complexity (AC): | MEDIUM |
Authentication (AU): | NONE |
Confidentiality (C): | PARTIAL |
Integrity (I): | PARTIAL |
Availability (A): | PARTIAL |
Additional information: |