CVE-2017-8314 - Vulnerability Details - OpenCVE

Directory Traversal in Zip Extraction built-in function in Kodi 17.1 and earlier allows arbitrary file write on disk via a Zip file as subtitles.

No CVSS v4.0

No CVSS v3.1

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction Required

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Debian	Debian Linux
Kodi	Kodi

Configuration 1 [-]

cpe:2.3:a:kodi:kodi:*:*:*:*:*:*:*:*

Configuration 2 [-]

cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://www.securityfocus.com/bid/98668
https://github.com/xbmc/xbmc/pull/12024
https://lists.debian.org/debian-lts-announce/2018/01/msg00019.html
https://security.gentoo.org/glsa/201706-17

History

No history.

MITRE

Status: PUBLISHED

Assigner: checkpoint

Published: 2017-05-23T21:00:00

Updated: 2024-08-05T16:34:22.480Z

Reserved: 2017-04-28T00:00:00

Link: CVE-2017-8314

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2017-05-23T21:29:00.337

Modified: 2025-04-20T01:37:25.860

Link: CVE-2017-8314

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "Kodi (XBMC)", "vendor": "XBMC Foundation", "versions": [{"status": "affected", "version": "<= v17.1"}]}], "datePublic": "2017-04-28T00:00:00", "descriptions": [{"lang": "en", "value": "Directory Traversal in Zip Extraction built-in function in Kodi 17.1 and earlier allows arbitrary file write on disk via a Zip file as subtitles."}], "problemTypes": [{"descriptions": [{"description": "Allows arbitrary file write on disk", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-02-02T10:57:01", "orgId": "897c38be-0345-43cd-b6cf-fe179e0c4f45", "shortName": "checkpoint"}, "references": [{"name": "GLSA-201706-17", "tags": ["vendor-advisory", "x_refsource_GENTOO"], "url": "https://security.gentoo.org/glsa/201706-17"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/xbmc/xbmc/pull/12024"}, {"name": "98668", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/98668"}, {"name": "[debian-lts-announce] 20180116 [SECURITY] [DLA 1243-1] xbmc security update", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "https://lists.debian.org/debian-lts-announce/2018/01/msg00019.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@checkpoint.com", "ID": "CVE-2017-8314", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Kodi (XBMC)", "version": {"version_data": [{"version_value": "<= v17.1"}]}}]}, "vendor_name": "XBMC Foundation"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Directory Traversal in Zip Extraction built-in function in Kodi 17.1 and earlier allows arbitrary file write on disk via a Zip file as subtitles."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Allows arbitrary file write on disk"}]}]}, "references": {"reference_data": [{"name": "GLSA-201706-17", "refsource": "GENTOO", "url": "https://security.gentoo.org/glsa/201706-17"}, {"name": "https://github.com/xbmc/xbmc/pull/12024", "refsource": "CONFIRM", "url": "https://github.com/xbmc/xbmc/pull/12024"}, {"name": "98668", "refsource": "BID", "url": "http://www.securityfocus.com/bid/98668"}, {"name": "[debian-lts-announce] 20180116 [SECURITY] [DLA 1243-1] xbmc security update", "refsource": "MLIST", "url": "https://lists.debian.org/debian-lts-announce/2018/01/msg00019.html"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T16:34:22.480Z"}, "title": "CVE Program Container", "references": [{"name": "GLSA-201706-17", "tags": ["vendor-advisory", "x_refsource_GENTOO", "x_transferred"], "url": "https://security.gentoo.org/glsa/201706-17"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/xbmc/xbmc/pull/12024"}, {"name": "98668", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/98668"}, {"name": "[debian-lts-announce] 20180116 [SECURITY] [DLA 1243-1] xbmc security update", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "https://lists.debian.org/debian-lts-announce/2018/01/msg00019.html"}]}]}, "cveMetadata": {"assignerOrgId": "897c38be-0345-43cd-b6cf-fe179e0c4f45", "assignerShortName": "checkpoint", "cveId": "CVE-2017-8314", "datePublished": "2017-05-23T21:00:00", "dateReserved": "2017-04-28T00:00:00", "dateUpdated": "2024-08-05T16:34:22.480Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:kodi:kodi:*:*:*:*:*:*:*:*", "matchCriteriaId": "CE294B68-9D5E-4F93-84CD-E07BDAA6DACB", "versionEndIncluding": "17.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*", "matchCriteriaId": "16F59A04-14CF-49E2-9973-645477EA09DA", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Directory Traversal in Zip Extraction built-in function in Kodi 17.1 and earlier allows arbitrary file write on disk via a Zip file as subtitles."}, {"lang": "es", "value": "Directorio Traversal en la funci\u00f3n integrada de extracci\u00f3n de Zip en Kodi 17.1 y versiones anteriores permite escritura arbitraria de archivos en disco a trav\u00e9s de un archivo Zip como subt\u00edtulos"}], "id": "CVE-2017-8314", "lastModified": "2025-04-20T01:37:25.860", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "version": "3.0"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2017-05-23T21:29:00.337", "references": [{"source": "cve@checkpoint.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/98668"}, {"source": "cve@checkpoint.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://github.com/xbmc/xbmc/pull/12024"}, {"source": "cve@checkpoint.com", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2018/01/msg00019.html"}, {"source": "cve@checkpoint.com", "tags": ["Third Party Advisory"], "url": "https://security.gentoo.org/glsa/201706-17"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/98668"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "https://github.com/xbmc/xbmc/pull/12024"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2018/01/msg00019.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://security.gentoo.org/glsa/201706-17"}], "sourceIdentifier": "cve@checkpoint.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "nvd@nist.gov", "type": "Primary"}]}