CVE-2020-36193

Katalog CVE

CVSS 7.5 · High KEV · sudah dieksploitasi EPSS 70,6%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada php archive tar, fedoraproject fedora +2 lainnya. Skor CVSS 3.1 7.5 (High) menurut NVD. Masuk katalog KEV CISA pada 25 Agustus 2022, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue to CVE-2020-28948.

Rincian

Terbit di NVD

18 Januari 2021

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-59: Improper Link Resolution Before File Access ('Link Following')

EPSS (30 hari)

70,6% peluang dieksploitasi; lebih tinggi dari 99,3% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

PEAR Archive_Tar Improper Link Resolution Vulnerability

Masuk KEV

25 Agustus 2022

Tenggat CISA

15 September 2022 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply updates per vendor instructions.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/pear/Archive_Tar/commit/cde460582ff389404b5b3ccb59374e9b389de916 patch
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-36193 pemerintah AS
• https://lists.debian.org/debian-lts-announce/2021/01/msg00018.html mailing list · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2021/04/msg00007.html mailing list · advisory pihak ketiga
• https://security.gentoo.org/glsa/202101-23 advisory pihak ketiga
• https://www.debian.org/security/2021/dsa-4894 advisory pihak ketiga
• https://www.drupal.org/sa-core-2021-001 advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/42GPGVVFTLJYA... broken link
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FOZNK4FIIV7FS... broken link
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VJQQYDAOWHD6R... broken link
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YKD5WEFA4WT6A... broken link