cyfenced.com →

[ CVE-2020-36193 · Published 18 Jan 2021 ]

PEAR Archive_Tar Improper Link Resolution Vulnerability

Exploited · CISA KEV CVSS 7.5 EPSS 71%Fix available

[ Why it matters ]Priority signals

  • Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2022-08-25
  • EPSS: 71% chance of exploitation in the next 30 days (higher than 99% of CVEs)

[ Description ]Official description

Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue to CVE-2020-28948.

CISA: PEAR Archive_Tar Tar.php allows write operations with directory traversal due to inadequate checking of symbolic links. PEAR stands for PHP Extension and Application Repository and it is an open-source framework and distribution system for reusable PHP components with known usage in third-party products such as Drupal Core and Red Hat Linux.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 15 Sep 2022): Apply updates per vendor instructions.

[ References ]References