Vulnerability Details : CVE-2020-7678
Potential exploit
This affects all versions of package node-import. The "params" argument of module function can be controlled by users without any sanitization.b. This is then provided to the “eval” function located in line 79 in the index file "index.js".
Products affected by CVE-2020-7678
- cpe:2.3:a:node-import_project:node-import:*:*:*:*:*:node.js:*:*
Exploit prediction scoring system (EPSS) score for CVE-2020-7678
0.09%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 27 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2020-7678
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
9.8
|
CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
3.9
|
5.9
|
NIST | |
|
8.6
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L |
3.9
|
4.7
|
Snyk |
References for CVE-2020-7678
-
https://github.com/mahdaen/node-import/blob/master/index.js%23L79
Page not found · GitHub · GitHubBroken Link;Third Party Advisory
-
https://security.snyk.io/vuln/SNYK-JS-NODEIMPORT-571691
Arbitrary Code Execution in node-import | CVE-2020-7678 | SnykExploit;Third Party Advisory
Jump to