Archive Tar
Vendor:
First CVE: Nov 19, 2020 · Active for 5 years
4
Total CVEs
More Total CVEs than 72% of tracked products
2.0
Avg CVEs / Year
Higher CVE frequency than 60% of tracked products
7.5
Avg CVSS
Higher Avg CVSS than 59% of tracked products
50.0%
KEV Rate
Higher KEV Rate than 98% of tracked products
Trends Over Time
The number and severity of CVEs published that impact Archive Tar over time
Volume of CVEsAvg CVSS Base Score
First CVE
Nov 19, 2020
5 years ago
Most Recent CVE
Jul 30, 2021
1,820 days ago
CVE Severity & Scoring
Archive Tar4 CVEs
100%
All CVEs352,231 CVEs
45%
40%
11%
High
Attack Vector
Local3 (75.0%)
Network1 (25.0%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low4 (100.0%)
High0 (0.0%)
Unknown0 (0.0%)
User Interaction
None2 (50.0%)
Unknown0 (0.0%)
Required2 (50.0%)
Privileges Required
Low1 (25.0%)
High0 (0.0%)
None3 (75.0%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (4 CVEs).
4 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2020-28949HIGH Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite files) can still succe | Nov 19, 2020 | 7.8 | 95 | YES | YES |
CVE-2020-36193HIGH Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue to CVE-2020-28948. | Jan 18, 2021 | 7.5 | 91 | YES | NO |
CVE-2021-32610HIGH In Archive_Tar before 1.4.14, symlinks can refer to targets outside of the extracted archive, a different vulnerability than CVE-2020-36193. | Jul 30, 2021 | 7.1 | 64 | NO | NO |
CVE-2020-28948HIGH Archive_Tar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked. | Nov 19, 2020 | 7.8 | 43 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (4 CVEs).
CISA KEV
2 CVEs
50.0% of CVEs· 98th percentile
Metasploit
1 CVE
25.0% of CVEs· 98th percentile
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (4 CVEs).
Media Mentions
Signals from CVEs in this product scope (4 CVEs).
Top CNAs Publishing CVEs For Archive Tar
Top CWEs
Versions
No cataloged versions.