CVE-2020-1913

Katalog CVE

CVSS 8.1 · High EPSS 1,2%

Kerentanan Signed to Unsigned Conversion Error pada facebook hermes. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

An Integer signedness error in the JavaScript Interpreter in Facebook Hermes prior to commit 2c7af7ec481ceffd0d14ce2d7c045e475fd71dc6 allows attackers to cause a denial of service attack or a potential RCE via crafted JavaScript. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected.

Rincian

Terbit di NVD

9 September 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-195: Signed to Unsigned Conversion Error
CWE-681: Incorrect Conversion between Numeric Types

EPSS (30 hari)

1,2% peluang dieksploitasi; lebih tinggi dari 67,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.facebook.com/security/advisories/cve-2020-1913 advisory vendor
• https://github.com/facebook/hermes/commit/2c7af7ec481ceffd0d14ce2d7c045e475fd71dc6 patch · advisory pihak ketiga