CVE-2023-0593

A path traversal vulnerability affects yaffshiv YAFFS filesystem extractor. By crafting a malicious YAFFS file, an attacker could force yaffshiv to write outside of the extraction directory.

This issue affects yaffshiv up to version 0.1 included, which is the most recent at time of publication.
Path Traversal
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
5.5 MEDIUM
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
ONEKEYCNA
5.5 MEDIUM
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CVEADP
---
---
CISA-ADPADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 24%
VendorProductVersion
yaffshiv_projectyaffshiv
𝑥
≤ 0.1
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/devttys0/yaffshiv/pull/3/files
https://onekey.com/blog/security-advisory-remote-command-execution-in-binwalk/
https://github.com/devttys0/yaffshiv/pull/3/files
https://onekey.com/blog/security-advisory-remote-command-execution-in-binwalk/