-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| net.lingala.zip4j:zip4j | maven | <= 2.11.2 | 2.11.3 |
Miggo AIRoot Cause AnalysisThe vulnerability (CVE-2023-22899) explicitly states that Zip4j failed to check the MAC during decryption. The MAC is critical for verifying the integrity and authenticity of encrypted data. The AES decryption process in Zip4j (handled by AesDecrypter) would logically include MAC validation. The patch in v2.11.3 likely added this check, confirming the vulnerability resided in the decryption flow where MAC verification was omitted. The Threema analysis also directly implicates the ZIP library's MAC validation failure, aligning with this function's responsibility.
JavaJavaOngoing coverage of React2Shell