CVE-2020-7677

Katalog CVE

CVSS 9.8 · Critical EPSS 2,1%

Kerentanan pada thenify project thenify, debian linux +1 lainnya. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

This affects the package thenify before 3.3.1. The name argument provided to the package can be controlled by users without any sanitization, and this is provided to the eval function without any sanitization.

Rincian

Terbit di NVD

25 Juli 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

EPSS (30 hari)

2,1% peluang dieksploitasi; lebih tinggi dari 81,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/thenables/thenify/commit/0d94a24eb933bc835d568f3009f4d269c4c4c17a patch
• https://lists.debian.org/debian-lts-announce/2022/09/msg00039.html mailing list · advisory pihak ketiga
• https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-572317 exploit · advisory pihak ketiga
• https://security.snyk.io/vuln/SNYK-JS-THENIFY-571690 exploit · advisory pihak ketiga
• https://github.com/thenables/thenify/blob/master/index.js%23L17 broken link
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MTEUUTNIEBHGK...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UM6XJ73Q3NAM5...