CVE-2020-36193
18.01.2021, 20:15
Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue to CVE-2020-28948.
| Vendor | Product | Version |
|---|---|---|
| php | archive_tar | 𝑥 ≤ 1.4.11 |
| debian | debian_linux | 9.0 |
| debian | debian_linux | 10.0 |
| drupal | drupal | 7.0 ≤ 𝑥 < 7.78 |
| drupal | drupal | 8.9.0 ≤ 𝑥 < 8.9.13 |
| drupal | drupal | 9.0.0 ≤ 𝑥 < 9.0.11 |
| drupal | drupal | 9.1.0 ≤ 𝑥 < 9.1.3 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Common Weakness Enumeration
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
- CWE-59 - Improper Link Resolution Before File Access ('Link Following')The software attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
References