CVE-2020-28949

HIGH KEV RANSOMWARE

Archive_Tar <1.4.10 - Code Injection

Title source: llm

Description

Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite files) can still succeed.

Exploits (2)

vulncheck_xdb WORKING POC
client-side
https://github.com/JinHao-L/PoC-for-CVE-2020-28948-CVE-2020-28949
metasploit WORKING POC EXCELLENT
by gwillcox-r7, xorathustra · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/fileformat/archive_tar_arb_file_write.rb

References (13)

Scores

CVSS v3 7.8
EPSS 0.9336
EPSS Percentile 99.8%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CISA KEV 2022-08-25
VulnCheck KEV 2022-08-25
InTheWild.io 2022-08-25
ENISA EUVD EUVD-2021-0783
Ransomware Use Confirmed
Status published
Products (9)
debian/debian_linux 9.0
debian/debian_linux 10.0
drupal/drupal 7.0 - 7.75
fedoraproject/fedora 32
fedoraproject/fedora 33
fedoraproject/fedora 34
fedoraproject/fedora 35
pear/archive_tar 0 - 1.4.11Packagist
php/archive_tar < 1.4.12
Published Nov 19, 2020
KEV Added Aug 25, 2022
Tracked Since Feb 18, 2026