8.4

CVE-2020-7688

Exploit

Command Injection

The issue occurs because tagName user input is formatted inside the exec function is executed without any checks.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Mversion Project ≫ Mversion Version < 2.0.1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.55% 0.416
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 4.6 3.9 6.4
AV:L/AC:L/Au:N/C:P/I:P/A:P
report@snyk.io 8.4 2.5 5.9
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

https://github.com/418sec/huntr/pull/102
Third Party Advisory
Exploit
https://github.com/mikaelbr/mversion/commit/b7a8b32600e60759a7ad3921ec4a2750bf173482
Patch
Third Party Advisory
https://snyk.io/vuln/SNYK-JS-MVERSION-573174
Third Party Advisory
Exploit