CVE-2020-13651

Katalog CVE

CVSS 7.8 · High EPSS 0,91%

Kerentanan Inclusion of Functionality from Untrusted Control Sphere pada digdash. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

An issue was discovered in DigDash 2018R2 before p20200528, 2019R1 before p20200421, and 2019R2 before p20200430. It allows a user to provide data that will be used to generate the JNLP file used by a client to obtain the right Java application. By providing an attacker-controlled URL, the client will obtain a rogue JNLP file specifying the installation of malicious JAR archives and executed with full privileges on the client computer.

Rincian

Terbit di NVD

15 Juni 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-829: Inclusion of Functionality from Untrusted Control Sphere

EPSS (30 hari)

0,91% peluang dieksploitasi; lebih tinggi dari 58,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://know.bishopfox.com/advisories/digdash-version-2018 advisory pihak ketiga