PatchSiren

PatchSiren cyber security CVE debrief

CVE-2022-30333 RARLAB CVE debrief

CVE-2022-30333 is a directory traversal vulnerability affecting RARLAB UnRAR. CISA added it to the Known Exploited Vulnerabilities catalog on 2022-08-09 and marked it as having known ransomware campaign use. The CISA entry directs organizations to apply vendor updates, and the source notes reference UnRAR version 6.12.

Vendor
RARLAB
Product
UnRAR
CVSS
HIGH 7.5
CISA KEV
Listed
Original CVE published
2022-08-09
Original CVE updated
2022-08-09
Advisory published
2022-08-09
Advisory updated
2022-08-09

Who should care

Organizations that use RARLAB UnRAR, especially teams responsible for archive handling, endpoint management, vulnerability remediation, and systems covered by CISA KEV response requirements.

Technical summary

The supplied corpus identifies the issue as a directory traversal vulnerability in RARLAB UnRAR. CISA classifies the CVE as known exploited and notes known ransomware campaign use. The source item metadata also references a vendor update to version 6.12 as the remediation path noted by CISA.

Defensive priority

High. This CVE is in CISA’s Known Exploited Vulnerabilities catalog, which indicates confirmed exploitation risk and time-sensitive remediation needs. The KEV entry also marks known ransomware campaign use.

Recommended defensive actions

  • Apply vendor updates per the CISA KEV guidance.
  • Prioritize remediation for any systems running RARLAB UnRAR, including endpoints and servers that process archives automatically.
  • Validate that deployments have moved to the vendor-referenced updated version 6.12.
  • Track remediation against the CISA due date of 2022-08-30 for KEV handling.
  • Review systems that regularly extract user-supplied archives and confirm they are patched and monitored.

Evidence notes

Evidence in the supplied corpus comes from the CISA KEV JSON entry, which lists vendorProject RARLAB, product UnRAR, dateAdded 2022-08-09, dueDate 2022-08-30, requiredAction 'Apply updates per vendor instructions,' and knownRansomwareCampaignUse 'Known.' The source item metadata also references an update to version 6.12. Official reference links provided in the corpus include the CVE record, NVD detail page, and CISA KEV catalog.

Sources and references

Verified primary and authoritative sources

  • CVE-2022-30333 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2022-30333

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2022-30333 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2022-30333

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

  • CISA Known Exploited Vulnerabilities catalog

    Publisher, destination, and source semantics verified

    URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

    Cybersecurity and Infrastructure Security Agency - Official CISA catalog of vulnerabilities known to be exploited in the wild.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

    cisa_kev

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.