Description
WinZip Mark-of-the-Web Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of WinZip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the handling of archive files. When opening an archive that bears the Mark-of-the-Web, WinZip removes the Mark-of-the-Web from the archive file. Following extraction, the extracted files also lack the Mark-of-the-Web. An attacker can leverage this vulnerability to execute arbitrary code in the context of the current user. Was ZDI-CAN-23983.
Published: 2024-11-22
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2024-49610 WinZip Mark-of-the-Web Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of WinZip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of archive files. When opening an archive that bears the Mark-of-the-Web, WinZip removes the Mark-of-the-Web from the archive file. Following extraction, the extracted files also lack the Mark-of-the-Web. An attacker can leverage this vulnerability to execute arbitrary code in the context of the current user. Was ZDI-CAN-23983.
History

Fri, 03 Jan 2025 23:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-670
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

Mon, 02 Dec 2024 21:15:00 +0000

Type Values Removed Values Added
First Time appeared Winzip
Winzip winzip
CPEs cpe:2.3:a:winzip:winzip:*:*:*:*:*:*:*:*
Vendors & Products Winzip
Winzip winzip
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 22 Nov 2024 21:15:00 +0000

Type Values Removed Values Added
Description WinZip Mark-of-the-Web Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of WinZip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of archive files. When opening an archive that bears the Mark-of-the-Web, WinZip removes the Mark-of-the-Web from the archive file. Following extraction, the extracted files also lack the Mark-of-the-Web. An attacker can leverage this vulnerability to execute arbitrary code in the context of the current user. Was ZDI-CAN-23983.
Title WinZip Mark-of-the-Web Bypass Vulnerability
Weaknesses CWE-693
References
Metrics cvssV3_0

{'score': 7.8, 'vector': 'CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

Subscriptions

Winzip Winzip
cve-icon MITRE

Status: PUBLISHED

Assigner: zdi

Published:

Updated: 2024-12-02T20:49:19.327Z

Reserved: 2024-09-13T18:05:09.514Z

Link: CVE-2024-8811

cve-icon Vulnrichment

Updated: 2024-12-02T20:49:12.368Z

cve-icon NVD

Status : Analyzed

Published: 2024-11-22T21:15:19.220

Modified: 2025-01-03T22:49:49.463

Link: CVE-2024-8811

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses