Home > Vulnerability Database > CVE-2021-32610

Mend.io Vulnerability Database

New vulnerability? Tell us about it!

CVE-2021-32610

Date: July 27, 2021

In Archive_Tar before 1.4.14, symlinks can refer to targets outside of the extracted archive, a different vulnerability than CVE-2020-36193.

Language: PHP

Severity Score

7.1

Related Resources (18)

Url: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CAODVMHGL5MHQWQAQTXQ7G7OE3VQZ7LS

Url: https://github.com/pear/Archive_Tar/commit/7789ebb2f34f9e4adb3a4152ad0d1548930a9755

Url: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G5LTY6COQYNMMHQJ3QIOJHEWCKD4XDFH/

Url: https://github.com/pear/Archive_Tar

Url: https://security-tracker.debian.org/tracker/CVE-2021-32610

Url: https://www.drupal.org/sa-core-2021-004

Url: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CAODVMHGL5MHQWQAQTXQ7G7OE3VQZ7LS/

Url: https://github.com/pear/Archive_Tar/commit/b5832439b1f37331fb4f87e67fe4f

Url: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VJQQYDAOWHD6RDITDRPHFW7WY6BS3V5N/

Url: https://nvd.nist.gov/vuln/detail/CVE-2021-32610

Url: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/42GPGVVFTLJYAKRI75IVB5R45NYQGEUR

Url: https://lists.debian.org/debian-lts-announce/2021/07/msg00023.html

Url: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/G5LTY6COQYNMMHQJ3QIOJHEWCKD4XDFH

Url: https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/42GPGVVFTLJYAKRI75IVB5R45NYQGEUR/

Url: https://github.com/pear/Archive_Tar/releases/tag/1.4.14

Url: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VJQQYDAOWHD6RDITDRPHFW7WY6BS3V5N

Url: https://access.redhat.com/security/cve/CVE-2021-32610

Url: https://www.mend.io/vulnerability-database/CVE-2021-32610

Severity Score

7.1

Weakness Type (CWE)

Improper Link Resolution Before File Access ('Link Following')

CWE-59

CVSS v3.1

Base Score:	7.1
Attack Vector (AV):	LOCAL
Attack Complexity (AC):	LOW
Privileges Required (PR):	LOW
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	HIGH
Integrity (I):	HIGH
Availability (A):	NONE

CVSS v2

Base Score:	3.6
Access Vector (AV):	LOCAL
Access Complexity (AC):	LOW
Authentication (AU):	NONE
Confidentiality (C):	PARTIAL
Integrity (I):	PARTIAL
Availability (A):	NONE
Additional information:

Do you need more information?

Contact Us