-
-
Save MarcinB44/2150484497c4b34aedf682c9091b14fa to your computer and use it in GitHub Desktop.
Rarlab WinRAR 7.11 Cross-site scripting (XSS) vulnerability
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| CVE ID: CVE-2025-52331 | |
| CVSS SCORE: 4.4, CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N | |
| AFFECTED VENDORS: Rarlab | |
| AFFECTED PRODUCTS: WinRAR | |
| AFFECTED VERSION: 7.11 | |
| VULNERABILITY TYPE: Cross Site Scripting (XSS) | |
| AFFECTED COMPONENT: "generate report" functionality | |
| ATTACK VECTORS: User must use the "generate report" functionality and open the report | |
| ATTACK TYPE: Local | |
| IMPACT: Information Disclosure | |
| VULNERABILITY DETAILS: Cross-site scripting (XSS) vulnerability in the generate report functionality in Rarlab WinRAR 7.11, | |
| allows attackers to disclose user information such as the computer username, generated report directory, and IP address. | |
| The generate report command includes archived file names without validation in the HTML report, which allows potentially | |
| malicious HTML tags to be injected into the report. User interaction is required. User must use the "generate report" functionality | |
| and open the report. | |
| REFERENCE: https://www.rarlab.com/rarnew.htm | |
| https://gist.github.com/MarcinB44/2150484497c4b34aedf682c9091b14fa | |
| ADDITIONAL INFORMATION: Fixed in WinRAR 7.12 beta 1 | |
| DISCOVERER: Marcin Bobryk (https://github.com/MarcinB44) |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment