CVE-2021-34422high

CVE-2021-34422: falha de alta gravidade em Zoom Video Communications Inc Keybase Client…

Path traversal of file names in Keybase Client for Windows

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Keybase Client

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.2epss 1.4%
The Keybase Client for Windows before version 5.7.0 contains a path traversal vulnerability when checking the name of a file uploaded to a team folder. A malicious user could upload a file to a shared folder with a specially crafted file name which could allow a user to execute an application which was not intended on their host machine. If a malicious user leveraged this issue with the public folder sharing feature of the Keybase client, this could lead to remote code execution.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Produtos afetados
Zoom Video Communications Inc · Keybase Client for Windows
CVEs relacionadas — Zoom Video Communications Inc Keybase Client…

No mesmo produto, das mais perigosas para as menos.

CVE-2022-22779LOWRetained exploded messages in Keybase clients for macOS and WindowsEPSS 0.8%CVE-2021-34426MEDIUMArbitrary command execution in Keybase Client for WindowsEPSS 0.2%