Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Arbitrary File Write via Archive Extraction (Zip Slip)
Vulnerability Description
All versions of package com.alibaba.oneagent:one-java-agent-plugin are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) using a specially crafted archive that holds directory traversal filenames (e.g. ../../evil.exe). The attacker can overwrite executable files and either invoke them remotely or wait for the system or user to call them, thus achieving remote command execution on the victim’s machine.
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:L
Vulnerability Type
N/A
Vulnerability Title
one-java-agent 路径遍历漏洞
Vulnerability Description
one-java-agent是提供插件化支持，统一管理众多的Java Agent。 com.alibaba.oneagent:one-java-agent-plugin 所有版本存在安全漏洞，攻击者利用该漏洞可以覆盖可执行文件并远程调用它们，或者等待系统或用户调用它们，从而在受害者的机器上实现远程命令执行。
CVSS Information
N/A
Vulnerability Type
N/A