CVE-2021-43099

An Archive Extraction (AKA "Zip Slip) vulnerability exists in bbs 5.3 in the UpgradeNow function in UpgradeManageAction.java, which unzips the arbitrary upladed zip file without checking filenames. The vulnerability is exploited using a specially crafted archive that holds directory traversal filenames (e.g. ../../evil.exe).

CVSS v3.1

4.9 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

CVSS v2.0

4.0 MEDIUMAV:N/AC:L/Au:S/C:N/I:P/A:N

EPSS

1.11% chance of exploitation in the next 30 days, 64th percentile

Published

2022-03-28

Updated

2024-08-04

Proof-of-concept exploits (1)

• diyhi/bbs/issues/51

References

• CVE Record
• NVD entry

Related

• CVE-2021-43097
• CVE-2021-43098
• CVE-2021-43100
• CVE-2021-43101
• CVE-2021-43102
• CVE-2021-43103