CVE-2015-6833 Information
Share on:
Feb 14, 2021
cve
Description
Directory traversal vulnerability in the PharData class in PHP before 5.4.44 5.5.x before 5.5.28 and 5.6.x before 5.6.12 allows remote attackers to write to arbitrary files via a .. (dot dot) in a ZIP archive entry that is mishandled during an extractTo call.
CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Reference
http://www.debian.org/security/2015/dsa-3344 http://www.openwall.com/lists/oss-security/2015/08/19/3 http://www.php.net/ChangeLog-5.php https://bugs.php.net/bug.php?id=70019 https://security.gentoo.org/glsa/201606-10
Attack Complexity
LOW
Privileges Required
NONE
User Interaction Required
NONE
Scope
NONE
Confidentiality Impact
UNCHANGED
Integrity Impact
NONE
Availability Impact
HIGH
Base Score
NONE
Base Severity
7.5