ExploitCVE-2023-7216
Improper Link Resolution Before File Access ('Link Following') (CWE-59)
Published: Feb 5, 2024 / Updated: 9mo ago
010
CVSS 5.3EPSS 0.14%Medium
CVE info copied to clipboard
A path traversal vulnerability was found in the CPIO utility. This issue could allow a remote unauthenticated attacker to trick a user into opening a specially crafted archive. During the extraction process, the archiver could follow symlinks outside of the intended directory, which could be utilized to run arbitrary commands on the target system.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Timeline
CVE Assignment
NVD published the first details for CVE-2023-7216
Feb 5, 2024 at 7:15 AM
First Article
Feedly found the first article mentioning CVE-2023-7216. See article
Feb 5, 2024 at 3:27 PM / National Vulnerability Database
Vendor Advisory
RedHat CVE advisory released a security advisory (CVE-2023-7216).
Feb 6, 2024 at 4:11 AM
EPSS
EPSS Score was set to: 0.14% (Percentile: 48.6%)
Feb 9, 2024 at 4:46 PM
CVSS
A CVSS base score of 5.3 has been assigned.
May 13, 2024 at 11:20 PM / nvd
Affected Systems
Gnu/cpio
+null more
Exploits
https://bugzilla.redhat.com/show_bug.cgi?id=2249901
+null more
Patches
bugzilla.redhat.com
+null more
Links to Mitre Att&cks
T1547.009: Shortcut Modification
+null more
Attack Patterns
CAPEC-132: Symlink Attack
+null more
Vendor Advisory
CVE-2023-7216
Red Hat Enterprise Linux 7 - cpio - Affected During the extraction process, the archiver could follow symlinks outside of the intended directory, which could be utilized to run arbitrary commands on the target system.
References
CVE-2023-7216
Red Hat Enterprise Linux 7 - cpio - Affected During the extraction process, the archiver could follow symlinks outside of the intended directory, which could be utilized to run arbitrary commands on the target system.
(CVE-2023-7216) CVE-2023-7216 CPIO: extraction allows symlinks which enables Remote Command Execution
This site requires JavaScript to be enabled to function correctly, please enable it.
News
OE-core CVE metrics for kirkstone on Sun 29 Sep 2024 02:00:01 AM HST
Branch: kirkstone New this week: 4 CVEs CVE-2023-27043 (CVSS3: 5.3 MEDIUM): python3:python3-native https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-27043 * CVE-2024-6232 (CVSS3: 7.5 HIGH): python3:python3-native https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-6232 * CVE-2024-7592 (CVSS3: 7.5 HIGH): python3:python3-native https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-7592 * CVE-2024-8354 (CVSS3: 5.5 MEDIUM):
OE-core CVE metrics for kirkstone on Sun 22 Sep 2024 02:00:01 AM HST
Branch: kirkstone New this week: 3 CVEs CVE-2023-7256 (CVSS3: 4.4 MEDIUM): libpcap https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-7256 * CVE-2024-5290 (CVSS3: 7.8 HIGH): wpa-supplicant https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-5290 * CVE-2024-8006 (CVSS3: 4.4 MEDIUM): libpcap https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-8006 * Removed this week: 6 CVEs CVE-2023-27043 (CVSS3:
OE-core CVE metrics for kirkstone on Sun 15 Sep 2024 02:00:01 AM HST
Branch: kirkstone New this week: 0 CVEs Removed this week: 0 CVEs Full list: Found 56 unpatched CVEs CVE-2020-14409 (CVSS3: 7.8 HIGH): libsdl2:libsdl2-native https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14409 * CVE-2020-14410 (CVSS3: 5.4 MEDIUM): libsdl2:libsdl2-native https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-14410 * CVE-2021-35937 (CVSS3: 6.4 MEDIUM):
OE-core CVE metrics for kirkstone on Sun 08 Sep 2024 02:00:01 AM HST
Branch: kirkstone New this week: 11 CVEs CVE-2023-41993 (CVSS3: 8.8 HIGH): webkitgtk https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-41993 * CVE-2024-45490 (CVSS3: 9.8 CRITICAL): expat:expat-native https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-45490 * CVE-2024-45491 (CVSS3: 9.8 CRITICAL): expat:expat-native https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-45491 * CVE-2024-45492 (CVSS3: 9.8 CRITICAL):
OE-core CVE metrics for kirkstone on Sun 25 Aug 2024 02:00:01 AM HST
Branch: kirkstone New this week: 3 CVEs CVE-2024-32928 (CVSS3: 5.9 MEDIUM): curl:curl-native https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-32928 * CVE-2024-35325 (CVSS3: 9.8 CRITICAL): libyaml:libyaml-native https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-35325 * CVE-2024-7592 (CVSS3: 7.5 HIGH): python3:python3-native https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-7592 * Removed this week: 0 CVEs Full list:
See 78 more articles and social media posts