CVE-2023-46122

Katalog CVE

CVSS 7.1 · High EPSS 0,34%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada scala-sbt io, scala-sbt sbt. Skor CVSS 3.1 7.1 (High) menurut NVD.

Deskripsi (NVD)

sbt is a build tool for Scala, Java, and others. Given a specially crafted zip or JAR file, `IO.unzip` allows writing of arbitrary file. This would have potential to overwrite `/root/.ssh/authorized_keys`. Within sbt's main code, `IO.unzip` is used in `pullRemoteCache` task and `Resolvers.remote`; however many projects use `IO.unzip(...)` directly to implement custom tasks. This vulnerability has been patched in version 1.9.7.

Rincian

Terbit di NVD

23 Oktober 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.1 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

0,34% peluang dieksploitasi; lebih tinggi dari 25,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/sbt/io/commit/124538348db0713c80793cb57b915f97ec13188a patch
• https://github.com/sbt/io/issues/358 issue tracking · patch
• https://github.com/sbt/io/pull/360 patch
• https://github.com/sbt/sbt/security/advisories/GHSA-h9mw-grgx-2fhf exploit · patch · advisory pihak ketiga