CVE-2020-28948

HIGH 7.8EPSS 47.5%

Archive_Tar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked.

CVSS v3.1: 7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v3.1: 7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v2.0: 6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
EPSS: 47.49% chance of exploitation in the next 30 days, 99th percentile
Published: 2020-11-19
Updated: 2024-08-04

Proof-of-concept exploits (4)

pear/Archive_Tar/issues/33
0x240x23elu/CVE-2020-28948-and-CVE-2020-289496★ · 2020-11-27
JinHao-L/PoC-for-CVE-2020-28948-CVE-2020-289490★ · 2022-10-17
nopdata/cve-2020-289480★ · 2021-05-24

References

Related