5.5

CVE-2018-1002200: codehaus-plexus plexus-archiver Path Traversal

CVSS: 5.5v3.0MediumModified
AliasesMGASA-2019-0005RHSA-2018:1836RHSA-2018:1837
Published 25-07-2018Last modified 05-08-2024
Open JSON

Vulnerability summary

CVE-2018-1002200 is a medium (CVSS 5.5) Path Traversal vulnerability in codehaus-plexus plexus-archiver. EPSS estimates a 11.58% chance of exploitation in the next 30 days, higher than 96% of scored vulnerabilities. 4 public exploits are recorded.

Overall risk
34/100
0100
Medium · default modelHow is this calculated?
CVSS score
5.5/10
010
Medium · v3.0 (NVD)
EPSS score
11.58%
0%100%
Medium · -1.60 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits4github, reference

Timeline

  1. 25-07-2018
    PublishedVulnerability first disclosed.
  2. 05-08-2024
    Last modifiedVulnerability information updated.

Description

plexus-archiver before 3.6.0 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in an archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.

CVSS metrics

7 scores · 6 sources · 2 versions

EPSS trend

Probability

11.58%

Chance of exploitation in the next 30 days

Percentile

96%

Versus all other CVEs

30-day change

-1.60 pp

From 13.18% on 19-09-2026

19-09-202619-10-2026
EPSS score
11.58%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

4 found
  • githubUnverified

    Zip Slip Vulnerability

    Maturity: poc

  • githubUnverified

    Plexus Archiver

    Maturity: poc

  • referenceUnverified

    Exploit Reference (snyk.io)

    Maturity: unknown

Show all 4 exploits
  • referenceUnverified

    Exploit Reference (snyk.io)

    Maturity: unknown

Weaknesses

CWE · root cause

Affected systems

Redhat9 products
Chainguard3 products
  • hadoop-fips-3.3.6All versions (No fix recorded)
  • hadoop-fips-3.4.2All versions (No fix recorded)
  • hadoop-fips-3.5All versions (No fix recorded)
Debian2 products
  • plexus-archiver< 3.6.0-1 | < 1.2-1+deb8u1 | < 2.2-1+deb9u1
  • debian_linuxEOL8.0 | 9.0
Codehaus1 product
Codehaus-plexus1 product
Mageia1 product
  • plexus-archiver< 3.4-1.1.mga6
Org.codehaus.plexus1 product
  • plexus-archiver< 3.6.0
Ubuntu1 product
  • plexus-archiver< 2.2-1+deb9u1build0.16.04.1 | < 3.5-2ubuntu0.1~esm1

8 vendors · 19 products

References

22 links
Show all 22 references