CVE-2023-40477 — Improper Validation of Array Index in Winrar
Severity
7.8HIGHNVD
EPSS
92.8%
top 0.24%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedMay 3
Latest updateMar 12
Description
RARLAB WinRAR Recovery Volume Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of RARLAB WinRAR. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the processing of recovery volumes. The issue results from the lack of proper validation of user-supplied data, which ca…
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9
Affected Packages3 packages
🔴Vulnerability Details
6GHSA▶
GHSA-58vr-f4x9-3h36: RARLAB WinRAR Recovery Volume Improper Validation of Array Index Remote Code Execution Vulnerability↗2024-05-03
OSV▶
CVE-2023-40477: RARLAB WinRAR Recovery Volume Improper Validation of Array Index Remote Code Execution Vulnerability↗2024-05-03
CVEList▶
RARLAB WinRAR Recovery Volume Improper Validation of Array Index Remote Code Execution Vulnerability↗2024-05-03