CVE-2024-30370 — MEDIUM (4.3)

Vulnerability Description

RARLAB WinRAR Mark-Of-The-Web Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-Of-The-Web protection mechanism on affected installations of RARLAB WinRAR. User interaction is required to exploit this vulnerability in that the target must perform a specific action on a malicious page. The specific flaw exists within the archive extraction functionality. A crafted archive entry can cause the creation of an arbitrary file without the Mark-Of-The-Web. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current user. Was ZDI-CAN-23156.

CVSS Score

4.3

MEDIUM

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality

NONE

Integrity

LOW

Availability

NONE

Affected Products

Vendor	Product	Versions
Rarlab	Winrar	7.00

Related Weaknesses (CWE)

CWE-693

References

https://www.rarlab.com/rarnew.htm#27.%20Busgs%20fixedRelease Notes
https://www.zerodayinitiative.com/advisories/ZDI-24-357/Third Party AdvisoryVDB Entry
https://www.rarlab.com/rarnew.htm#27.%20Busgs%20fixedRelease Notes
https://www.zerodayinitiative.com/advisories/ZDI-24-357/Third Party AdvisoryVDB Entry

FAQ

What is CVE-2024-30370?

CVE-2024-30370 is a vulnerability with a CVSS score of 4.3 (MEDIUM). RARLAB WinRAR Mark-Of-The-Web Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-Of-The-Web protection mechanism on affected installations of RARLAB WinRAR. User inter...

How severe is CVE-2024-30370?

CVE-2024-30370 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2024-30370?

Check the references section above for vendor advisories and patch information. Affected products include: Rarlab Winrar.