« Volver al listado

CVE-2020-9479

Estado: ModificadaMedia (5.5)—

When loading a UDF, a specially crafted zip file could allow files to be placed outside of the UDF deployment directory. This issue affected Apache AsterixDB unreleased builds between commits 580b81aa5e8888b8e1b0620521a1c9680e54df73 and 28c0ee84f1387ab5d0659e9e822f4e3923ddc22d. Note: this CVE may be REJECTed as the issue did not affect any released versions of Apache AsterixDB

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Apache — Asterixdb

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-9479",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.5,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@apache.org",
      "affectedData": [
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache AsterixDB",
          "versions": [
            {
              "status": "affected",
              "version": "Apache AsterixDB git"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-03-01T16:15:12.917",
  "references": [
    {
      "url": "https://lists.apache.org/thread.html/r4cc9cc9c54573babf821c31d5d410fb260d1cd416dc1b225d587be9b%40%3Cdev.asterixdb.apache.org%3E",
      "source": "security@apache.org"
    },
    {
      "url": "https://www.openwall.com/lists/oss-security/2020/08/08/2",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "https://lists.apache.org/thread.html/r4cc9cc9c54573babf821c31d5d410fb260d1cd416dc1b225d587be9b%40%3Cdev.asterixdb.apache.org%3E",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.openwall.com/lists/oss-security/2020/08/08/2",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "When loading a UDF, a specially crafted zip file could allow files to be placed outside of the UDF deployment directory. This issue affected Apache AsterixDB unreleased builds between commits 580b81aa5e8888b8e1b0620521a1c9680e54df73 and 28c0ee84f1387ab5d0659e9e822f4e3923ddc22d. Note: this CVE may be REJECTed as the issue did not affect any released versions of Apache AsterixDB"
    },
    {
      "lang": "es",
      "value": "Cuando se carga un UDF, un archivo zip especialmente diseñado podría permitir que archivos sean colocados fuera del directorio de implementación del UDF. Este problema afectó a compilaciones inéditas de Apache AsterixDB entre las commits 580b81aa5e8888b8e1b0620521a1c9680e54df73 y 28c0ee84f1387ab5d0659e9e822f4e3923ddc22d. Nota: este CVE puede ser RECHAZADO ya que el problema no afectó ninguna versión publicada de Apache AsterixDB"
    }
  ],
  "lastModified": "2026-06-17T03:28:01.263",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:asterixdb:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "16A5B66C-7D3D-4738-A96D-A202971F07B2",
              "versionEndExcluding": "0.9.5"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@apache.org"
}