CVE-2020-15690 : In Nim before 1.2.6, the standard library asyncftpclient lacks a check for wheth

In Nim before 1.2.6, the standard library asyncftpclient lacks a check for whether a message contains a newline character.

Published 2021-01-30 06:15:13

Updated 2021-02-09 18:50:04

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2020-15690

Nim-lang » NIM
Versions before (<) 1.2.6
cpe:2.3:a:nim-lang:nim:*:*:*:*:*:*:*:*
Matching versions

EPSS FAQ

0.91%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 74 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.5	HIGH	AV:N/AC:L/Au:N/C:P/I:P/A:P	10.0	6.4	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Assigned by: nvd@nist.gov (Primary)

http://www.openwall.com/lists/oss-security/2021/02/04/3

oss-security - [CVE-2020-15690] Nim - stdlib asyncftpd - Crlf Injection
Exploit;Mailing List;Third Party Advisory
https://consensys.net/diligence/vulnerabilities/nim-asyncftpd-crlf-injection/

Nim - stdlib asyncftpd - Crlf Injection | ConsenSys Diligence
Exploit;Third Party Advisory
https://github.com/tintinweb/pub/tree/master/pocs/cve-2020-15690

pub/pocs/cve-2020-15690 at master · tintinweb/pub · GitHub
Exploit;Third Party Advisory
https://github.com/nim-lang/Nim/blob/dc5a40f3f39c6ea672e6dc6aca7f8118a69dda99/lib/pure/asyncftpclient.nim#L145

Nim/asyncftpclient.nim at dc5a40f3f39c6ea672e6dc6aca7f8118a69dda99 · nim-lang/Nim · GitHub
Exploit;Third Party Advisory
https://github.com/nim-lang/Nim/compare/v1.2.4...v1.2.6

Comparing v1.2.4...v1.2.6 · nim-lang/Nim · GitHub
Patch;Third Party Advisory

Jump to