Description
A vulnerability arises out of a failure to comprehensively sanitize the processing of a zip file(s). Incomplete neutralization of external commands used to control the process execution of the .zip application allows an authorized user to obtain control of the .zip application to execute arbitrary commands or obtain elevation of system privileges.
References (1)
Core 1
Core References
Vendor Advisory
https://kcm.trellix.com/corporate/index?page=content&id=SB10403
Scores
CVSS v3
8.1
EPSS
0.0085
EPSS Percentile
53.6%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-78
Status
published
Products (1)
trellix/enterprise_security_manager
< 11.6.7
Published
Jul 03, 2023
Tracked Since
Feb 18, 2026