CVEvulnerability

CVE-2014-9983

5.5 MEDIUM Published 2017-06-04 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2017-06-04
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
5.5 MEDIUM — CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
Weaknesses
CWE-22

Description

Directory Traversal exists in RAR 4.x and 5.x because an unpack operation follows any symlinks, including symlinks contained in the archive. This allows remote attackers to write to arbitrary files via a crafted archive.

Affected configurations

• rarlab rar 4.00 • rarlab rar 4.01 • rarlab rar 4.10 • rarlab rar 4.11 • rarlab rar 4.20 • rarlab rar 5.00 • rarlab rar 5.01 • rarlab rar 5.10 • rarlab rar 5.11 • rarlab rar 5.20 • rarlab rar 5.21 • rarlab rar 5.30 • rarlab rar 5.31 • rarlab rar 5.40 • rarlab rar 5.50

Related

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References