CVE-2020-36911

Katalog CVE

CVSS 9.8 · Critical EPSS 12,3%

Kerentanan Use of Hard-coded Credentials pada cobbr covenant. Skor CVSS 3.1 9.8 (Critical) menurut vulncheck.com.

Deskripsi (NVD)

Covenant 0.1.3 - 0.5 contains a remote code execution vulnerability that allows attackers to craft malicious JWT tokens with administrative privileges. Attackers can generate forged tokens with admin roles and upload custom DLL payloads to execute arbitrary commands on the target system.

Rincian

Terbit di NVD

13 Januari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-798: Use of Hard-coded Credentials

EPSS (30 hari)

12,3% peluang dieksploitasi; lebih tinggi dari 96,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://web.archive.org/web/20201101052547/https://blog.null.farm/hunting-the-hunters exploit · advisory pihak ketiga
• https://www.vulncheck.com/advisories/covenant-remote-code-execution-rce advisory pihak ketiga
• https://www.exploit-db.com/exploits/51141 exploit
• https://cobbr.io/Covenant.html broken link
• https://github.com/Zeop-CyberSec/covenant_rce/blob/master/covenant_jwt_rce.rb product
• https://github.com/cobbr/Covenant product
• https://web.archive.org/web/20201013165001/https://twitter.com/cobbr_io/status/1316058367161401344 issue tracking