PYSEC-2022-223

vendorUSosv

view advisory published 2022-07-08Licence: CC-BY-4.0

mat2 (aka metadata anonymisation toolkit) before 0.13.0 allows ../ directory traversal during the ZIP archive cleaning process. This primarily affects mat2 web instances, in which clients could obtain sensitive information via a crafted archive.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2022-35410US	high7.5	2.27% (83rd)	—	2022-07-08
mat2 (aka metadata anonymisation toolkit) before 0.13.0 allows ../ directory traversal during the ZIP archive cleaning process. This primarily affects mat2 web instances, in which…

references

External citations — patches, advisories, analysis.

https://0xacab.org/jvoisin/mat2/-/commit/beebca4bf1cd3b935824c966ce077e7bcf610385WEB
https://0xacab.org/jvoisin/mat2/-/issues/174WEB
https://dustri.org/b/mat2-0130.htmlWEB
https://github.com/advisories/GHSA-f33p-9287-h552ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan