Path Traversal in Nozomi Networks Arc
CVE-2023-5938
Multiple functions use archives without properly validating the filenames therein, rendering the application vulnerable to path traversal via 'zip slip' attacks. An administrator able to provide tampered archives to be processed by the affected versions of Arc may be able to have arbitrary files extracted to arbitrary filesystem locations. Leveraging this issue, an attacker may be able to overwrite arbitrary files on the target filesystem and cause critical impacts on the system (e.g., arbitrary command execution on the victim’s machine).
Vulnerability class: Path Traversal (Directory Traversal)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.0 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.007 (50.3th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 50th percentile — 50.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.007 · newest: 0.007 · change: 0.000
Affected products
- Nozomi Networks Arc — versions 0
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2023-5938?
- CVE-2023-5938 is a high-severity vulnerability in Nozomi Networks Arc, classified under Path Traversal. CVSS score: 8.0/10. Published 2024-05-15.
- How severe is CVE-2023-5938?
- High severity. CVSS v3 base score is 8.0 out of 10.