9.8

CVE-2020-7678

Exploit

Arbitrary Code Execution

This affects all versions of package node-import. The "params" argument of module function can be controlled by users without any sanitization.b. This is then provided to the “eval” function located in line 79 in the index file "index.js".
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Node-import Project ≫ Node-import SwPlatformnode.js
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.92% 0.554
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
report@snyk.io 8.6 3.9 4.7
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://github.com/mahdaen/node-import/blob/master/index.js%23L79
Third Party Advisory
Broken Link
https://security.snyk.io/vuln/SNYK-JS-NODEIMPORT-571691
Third Party Advisory
Exploit