CVE-2025-46652

Katalog CVE

CVSS 6.1 · Medium EPSS 0,32%

Kerentanan Inclusion of Web Functionality from an Untrusted Source. Skor CVSS 3.1 6.1 (Medium) menurut mitre.org.

Deskripsi (NVD)

In IZArc through 4.5, there is a Mark-of-the-Web Bypass Vulnerability. When a user performs an extraction from an archive file that bears Mark-of-the-Web, Mark-of-the-Web is not propagated to the extracted files. NOTE: this is disputed because Mark-of-the-Web propagation can increase risk via security-warning habituation, and because the intended control sphere for file-origin metadata (e.g., HostUrl in Zone.Identifier) may be narrower than that for reading the file's content.

Rincian

Terbit di NVD

26 April 2025

Terakhir diubah

17 Juni 2026

Status NVD

Deferred

CVSS 3.1

6.1 (Medium), sumber mitre.org
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-830: Inclusion of Web Functionality from an Untrusted Source

EPSS (30 hari)

0,32% peluang dieksploitasi; lebih tinggi dari 23,6% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/EnisAksu/Argonis/blob/main/CVEs/IZArc/IZArc%20Mark-of-the-Web%20Bypass%20Vulnerability.md
• https://github.com/EnisAksu/Argonis/security/advisories/GHSA-637g-8v47-79mv
• https://www.izarc.org/news