CISA-ADP AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CISA-ADP CWE-122

MITRE disputed

** DISPUTED ** 7-Zip through 21.07 on Windows allows privilege escalation and command execution when a file with the .7z extension is dragged to the Help>Contents area. This is caused by misconfiguration of 7z.dll and a heap overflow. The command runs in a child process under the 7zFM.exe process. NOTE: multiple third parties have reported that no privilege escalation can occur.

7-Zip through 21.07 on Windows allows privilege escalation and command execution when a file with the .7z extension is dragged to the Help>Contents area. This is caused by misconfiguration of 7z.dll and a heap overflow. The command runs in a child process under the 7zFM.exe process. NOTE: multiple third parties have reported that no privilege escalation can occur

AND
     OR
          *cpe:2.3:a:7-zip:7-zip:*:*:*:*:*:*:*:* versions up to (including) 21.07
     OR
          cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

NIST (AV:L/AC:L/Au:N/C:C/I:C/A:C)

NIST AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NIST CWE-787

http://packetstormsecurity.com/files/166763/7-Zip-21.07-Code-Execution-Privilege-Escalation.html No Types Assigned

http://packetstormsecurity.com/files/166763/7-Zip-21.07-Code-Execution-Privilege-Escalation.html Broken Link

https://github.com/kagancapar/CVE-2022-29072 No Types Assigned

https://github.com/kagancapar/CVE-2022-29072 Exploit, Third Party Advisory

https://news.ycombinator.com/item?id=31070256 No Types Assigned

https://news.ycombinator.com/item?id=31070256 Issue Tracking, Third Party Advisory

https://sourceforge.net/p/sevenzip/bugs/2337/ No Types Assigned

https://sourceforge.net/p/sevenzip/bugs/2337/ Exploit, Issue Tracking, Third Party Advisory

https://www.youtube.com/watch?v=sT1cvbu7ZTA No Types Assigned

https://www.youtube.com/watch?v=sT1cvbu7ZTA Exploit, Third Party Advisory

** DISPUTED ** 7-Zip through 21.07 on Windows allows privilege escalation and command execution when a file with the .7z extension is dragged to the Help>Contents area. This is caused by misconfiguration of 7z.dll and a heap overflow. The command runs in a child process under the 7zFM.exe process, NOTE: multiple third parties have reported that no privilege escalation can occur.

** DISPUTED ** 7-Zip through 21.07 on Windows allows privilege escalation and command execution when a file with the .7z extension is dragged to the Help>Contents area. This is caused by misconfiguration of 7z.dll and a heap overflow. The command runs in a child process under the 7zFM.exe process. NOTE: multiple third parties have reported that no privilege escalation can occur.

7-Zip through 21.07 on Windows allows privilege escalation and command execution when a file with the .7z extension is dragged to the Help>Contents area. This is caused by misconfiguration of 7z.dll and a heap overflow. The command runs in a child process under the 7zFM.exe process,

** DISPUTED ** 7-Zip through 21.07 on Windows allows privilege escalation and command execution when a file with the .7z extension is dragged to the Help>Contents area. This is caused by misconfiguration of 7z.dll and a heap overflow. The command runs in a child process under the 7zFM.exe process, NOTE: multiple third parties have reported that no privilege escalation can occur.

http://packetstormsecurity.com/files/166763/7-Zip-21.07-Code-Execution-Privilege-Escalation.html [No Types Assigned]

https://news.ycombinator.com/item?id=31070256 [No Types Assigned]

7-Zip through 21.07 on Windows allows privilege escalation and command execution when a file with the .7z extension is dragged to the Help>Contents area.

7-Zip through 21.07 on Windows allows privilege escalation and command execution when a file with the .7z extension is dragged to the Help>Contents area. This is caused by misconfiguration of 7z.dll and a heap overflow. The command runs in a child process under the 7zFM.exe process,

https://github.com/kagancapar/CVE-2022-29072 [No Types Assigned]