Description
A zip-slip path traversal vulnerability in Spring Data Geode's import snapshot functionality allows attackers to write files outside the intended extraction directory. This vulnerability appears to be susceptible on Windows OS only.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
VMware Spring Data Geode
Default version status: unaffected
2.0.0.RELEASE to ≤ 2.7.18affected
VMware Spring Data Gemfire
Default version status: unaffected
1.7.0.RELEASE to ≤ 2.2.13.RELEASEaffected