CVE-2020-27637

Katalog CVE

CVSS 9.8 · Critical EPSS 2,3%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada r-project cran. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

The R programming language’s default package manager CRAN is affected by a path traversal vulnerability that can lead to server compromise. This vulnerability affects packages installed via the R CMD install cli command or the install.packages() function from the interpreter. Update to version 4.0.3

Rincian

Terbit di NVD

12 Januari 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

2,3% peluang dieksploitasi; lebih tinggi dari 82,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.r-project.org/foundation/ advisory vendor
• https://labs.bishopfox.com/advisories/cran-version-4.0.2 exploit · advisory pihak ketiga
• https://security.gentoo.org/glsa/202401-07