VULNERABILITY INTELLIGENCE

CVE-2021-43099

CVSS score4.9 MEDIUM
EPSS probability1.11%
CISA KEVNot currently listed
Published2022-03-28
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Description

An Archive Extraction (AKA "Zip Slip) vulnerability exists in bbs 5.3 in the UpgradeNow function in UpgradeManageAction.java, which unzips the arbitrary upladed zip file without checking filenames. The vulnerability is exploited using a specially crafted archive that holds directory traversal filenames (e.g. ../../evil.exe).

Weakness classification

  • nvd@nist.gov: CWE-22

Primary references