LiveActive security incident?Get immediate response
CVE Record

CVE-2022-4976: Archive::Unzip::Burst from 0.01 through 0.09 for Perl contains a bundled InfoZip library that is affected by several vulnerabilities

Archive::Unzip::Burst from 0.01 through 0.09 for Perl contains a bundled InfoZip library that is affected by several vulnerabilities. The bundled library is affected by CVE-2014-8139, CVE-2014-8140 and CVE-2014-8141.

CriticalCVSS 9.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysiscritical

Security readout for executives and security teams

Plain-English summary

A Perl archive module bundles an old InfoZip library with known vulnerabilities. If an application uses affected Archive::Unzip::Burst versions to process attacker-supplied ZIP files, compromise of confidentiality, integrity, and availability is possible according to the CVSS rating.

Executive priority

Treat as high priority if this module is present in production or customer-facing upload paths. If absent, record the finding as not applicable after dependency validation.

Technical view

CVE-2022-4976 covers Archive::Unzip::Burst 0.01 through 0.09 bundling vulnerable InfoZip code affected by CVE-2014-8139, CVE-2014-8140, and CVE-2014-8141. The record assigns CVSS 3.1 9.8 and CWE-1395, indicating vulnerable third-party component dependency.

Likely exposure

Exposure is likely limited to Perl applications that include Archive-Unzip-Burst and use it to handle ZIP archives. The bundle says versions 0.01 through 0.09 are affected, while the structured affected entry only lists 0.01, so verify installed versions directly.

Exploitation context

The bundle does not identify active exploitation, and KEV status is false. Risk is highest where internet-facing or user-facing systems automatically unpack untrusted ZIP files with this module.

Researcher notes

Evidence is limited to the CVE description and CPAN issue reference. No source in the bundle names a fixed version, exploit status, or detailed vulnerable code path beyond the bundled InfoZip dependency.

Mitigation direction

  • Inventory Perl dependencies for Archive-Unzip-Burst.
  • Check CPAN, CVE, and vendor issue guidance for a fixed release.
  • Remove or replace affected versions where feasible.
  • Isolate workflows that unpack untrusted ZIP files using this module.
  • Avoid processing untrusted ZIP files until remediation is confirmed.

Validation and detection

  • Check dependency manifests and deployed package inventories.
  • Confirm whether versions 0.01 through 0.09 are present.
  • Trace whether untrusted ZIP files reach this module.
  • Review the CPAN issue for maintainer guidance or updates.
  • Document any compensating controls around archive ingestion.
Prepared
Confidence
medium
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-1395: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2022-4976 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Critical
CVSS
9.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
9.8CVSS 3.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

9.8Critical
CVSS 3.1 vector shape for CVE-2022-4976Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
ETJArchive::Unzip::BurstArchive-Unzip-Burst, 0.01unaffected
Weakness

CWE details

CWE-1395

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-1395 · source CWE mapping

Dependency on Vulnerable Third-Party Component

Dependency on Vulnerable Third-Party Component represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs