RARLAB WinRAR Mark-Of-The-Web Bypass Vulnerability

Description

RARLAB WinRAR Mark-Of-The-Web Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-Of-The-Web protection mechanism on affected installations of RARLAB WinRAR. User interaction is required to exploit this vulnerability in that the target must perform a specific action on a malicious page. The specific flaw exists within the archive extraction functionality. A crafted archive entry can cause the creation of an arbitrary file without the Mark-Of-The-Web. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current user. Was ZDI-CAN-23156.

Scores

EPSS (exploitation in 30 days)

1.2% · top 33% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.3.

Weakness

• CWE-693: Protection Mechanism Failure (opens in a new tab)All about CWE-693 and its CVEs

Affected products

• RARLAB · WinRAR

  • affected 7.00 beta 4 (64-bit)

References (2)

• ZDI-24-357 (opens in a new tab)x_research-advisoryx_transferred
• vendor-provided URL (opens in a new tab)vendor-advisoryx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2024-30370](https://trackcve.app/badge/CVE-2024-30370.svg)](https://trackcve.app/cve/CVE-2024-30370)

Record last updated 2 Aug 2024, 01:32 UTC.