CVE-2023-7216

Katalog CVE

CVSS 5.3 · Medium EPSS 0,90%

Kerentanan Improper Link Resolution Before File Access ('Link Following') pada gnu cpio, redhat enterprise linux. Skor CVSS 3.1 5.3 (Medium) menurut redhat.com.

Deskripsi (NVD)

A path traversal vulnerability was found in the CPIO utility. This issue could allow a remote unauthenticated attacker to trick a user into opening a specially crafted archive. During the extraction process, the archiver could follow symlinks outside of the intended directory, which allows files to be written in arbitrary directories through symlinks.

Rincian

Terbit di NVD

5 Februari 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.3 (Medium), sumber redhat.com
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-59: Improper Link Resolution Before File Access ('Link Following')
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

0,90% peluang dieksploitasi; lebih tinggi dari 58,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/security/cve/CVE-2023-7216 advisory pihak ketiga
• https://bugzilla.redhat.com/show_bug.cgi?id=2249901 exploit · issue tracking · advisory pihak ketiga