fkie_cve-2025-0851
Vulnerability from fkie_nvd
Published
2025-01-29 22:15
Modified
2025-01-29 22:15
Severity ?
Summary
A path traversal issue in ZipUtils.unzip and TarUtils.untar in Deep Java Library (DJL) on all platforms allows a bad actor to write files to arbitrary locations.
References
Impacted products
Vendor | Product | Version |
---|
{ cveTags: [], descriptions: [ { lang: "en", value: "A path traversal issue in ZipUtils.unzip and TarUtils.untar in Deep Java Library (DJL) on all platforms allows a bad actor to write files to arbitrary locations.", }, { lang: "es", value: "Un problema Path Traversal en ZipUtils.unzip y TarUtils.untar en Deep Java librería (DJL) en todas las plataformas permite que un actor malintencionado escriba archivos en ubicaciones arbitrarias.", }, ], id: "CVE-2025-0851", lastModified: "2025-01-29T22:15:30.463", metrics: { cvssMetricV31: [ { cvssData: { attackComplexity: "LOW", attackVector: "NETWORK", availabilityImpact: "HIGH", baseScore: 9.8, baseSeverity: "CRITICAL", confidentialityImpact: "HIGH", integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", userInteraction: "NONE", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, exploitabilityScore: 3.9, impactScore: 5.9, source: "ff89ba41-3aa1-4d27-914a-91399e9639e5", type: "Secondary", }, ], cvssMetricV40: [ { cvssData: { attackComplexity: "LOW", attackRequirements: "NONE", attackVector: "NETWORK", automatable: "NOT_DEFINED", availabilityRequirements: "NOT_DEFINED", baseScore: 9.3, baseSeverity: "CRITICAL", confidentialityRequirements: "NOT_DEFINED", exploitMaturity: "NOT_DEFINED", integrityRequirements: "NOT_DEFINED", modifiedAttackComplexity: "NOT_DEFINED", modifiedAttackRequirements: "NOT_DEFINED", modifiedAttackVector: "NOT_DEFINED", modifiedPrivilegesRequired: "NOT_DEFINED", modifiedSubsequentSystemAvailability: "NOT_DEFINED", modifiedSubsequentSystemConfidentiality: "NOT_DEFINED", modifiedSubsequentSystemIntegrity: "NOT_DEFINED", modifiedUserInteraction: "NOT_DEFINED", modifiedVulnerableSystemAvailability: "NOT_DEFINED", modifiedVulnerableSystemConfidentiality: "NOT_DEFINED", modifiedVulnerableSystemIntegrity: "NOT_DEFINED", privilegesRequired: "NONE", providerUrgency: "NOT_DEFINED", recovery: "NOT_DEFINED", safety: "NOT_DEFINED", subsequentSystemAvailability: "NONE", subsequentSystemConfidentiality: "NONE", subsequentSystemIntegrity: "NONE", userInteraction: "NONE", valueDensity: "NOT_DEFINED", vectorString: "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", version: "4.0", vulnerabilityResponseEffort: "NOT_DEFINED", vulnerableSystemAvailability: "HIGH", vulnerableSystemConfidentiality: "HIGH", vulnerableSystemIntegrity: "HIGH", }, source: "ff89ba41-3aa1-4d27-914a-91399e9639e5", type: "Secondary", }, ], }, published: "2025-01-29T22:15:30.463", references: [ { source: "ff89ba41-3aa1-4d27-914a-91399e9639e5", url: "https://aws.amazon.com/security/security-bulletins/AWS-2025-003/", }, { source: "ff89ba41-3aa1-4d27-914a-91399e9639e5", url: "https://github.com/deepjavalibrary/djl/security/advisories/GHSA-jcrp-x7w3-ffmg", }, ], sourceIdentifier: "ff89ba41-3aa1-4d27-914a-91399e9639e5", vulnStatus: "Awaiting Analysis", weaknesses: [ { description: [ { lang: "en", value: "CWE-36", }, { lang: "en", value: "CWE-73", }, ], source: "ff89ba41-3aa1-4d27-914a-91399e9639e5", type: "Secondary", }, ], }
Log in or create an account to share your comment.
Security Advisory comment format.
This schema specifies the format of a comment related to a security advisory.
Title of the comment
Description of the comment
Loading…
Loading…
Loading…
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.