CVE-2018-1797

MEDIUM

IBM WebSphere Application Server 7.0.0.0-7.0.0.45 - Path Traversal via ZIP Archive Extraction

Title source: llm

Description

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 using Enterprise bundle Archives (EBA) could allow a local attacker to traverse directories on the system. By persuading a victim to extract a specially-crafted ZIP archive containing "dot dot slash" sequences (../), an attacker could exploit this vulnerability to write to arbitrary files on the system. Note: This vulnerability is known as "Zip-Slip". IBM X-Force ID: 149427.

References (4)

Core 4

Core References

VDB Entry, Vendor Advisory vdb-entry x_refsource_xf

https://exchange.xforce.ibmcloud.com/vulnerabilities/149427

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/105982

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id/1042146

Patch, Vendor Advisory x_refsource_confirm

https://www.ibm.com/support/docview.wss?uid=ibm10730699

Scores

CVSS v3 6.3

EPSS 0.0195

EPSS Percentile 77.8%

Attack Vector LOCAL

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N

Details

CWE

CWE-22

Status published

Products (1)

ibm/websphere_application_server 7.0.0.0 - 7.0.0.45

Published Nov 16, 2018

Tracked Since Feb 18, 2026