CVE-2020-28472

Katalog CVE

CVSS 9.8 · Critical EPSS 2,1%

Kerentanan pada amazon aws sdk for javascipt, amazon aws shared configuration file loader. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

This affects the package @aws-sdk/shared-ini-file-loader before 1.0.0-rc.9; the package aws-sdk before 2.814.0. If an attacker submits a malicious INI file to an application that parses it with loadSharedConfigFiles , they will pollute the prototype on the application. This can be exploited further depending on the context.

Rincian

Terbit di NVD

19 Januari 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

EPSS (30 hari)

2,1% peluang dieksploitasi; lebih tinggi dari 81,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/aws/aws-sdk-js-v3/commit/a209082dff913939672bb069964b33aa4c5409a9 patch · advisory pihak ketiga
• https://github.com/aws/aws-sdk-js/pull/3585/commits/7d72aff2a941173733fcb6741b104cd83d3bc611 patch · advisory pihak ketiga
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1059426 exploit · advisory pihak ketiga
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1059425 exploit · advisory pihak ketiga
• https://snyk.io/vuln/SNYK-JS-AWSSDK-1059424 exploit · advisory pihak ketiga
• https://snyk.io/vuln/SNYK-JS-AWSSDKSHAREDINIFILELOADER-1049304 exploit · advisory pihak ketiga