Vulnerability Details : CVE-2020-8244
Potential exploit
A buffer over-read vulnerability exists in bl <4.0.3, <3.0.1, <2.2.1, and <1.2.3 which could allow an attacker to supply user input (even typed) that if it ends up in consume() argument and can become negative, the BufferList state can be corrupted, tricking it into exposing uninitialized memory via regular .slice() calls.
Products affected by CVE-2020-8244
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
- Bufferlist Project » Bufferlist » For Node.jsVersions from including (>=) 2.0.0 and before (<) 2.2.1cpe:2.3:a:bufferlist_project:bufferlist:*:*:*:*:*:node.js:*:*
- Bufferlist Project » Bufferlist » For Node.jsVersions from including (>=) 4.0.0 and before (<) 4.0.3cpe:2.3:a:bufferlist_project:bufferlist:*:*:*:*:*:node.js:*:*
- cpe:2.3:a:bufferlist_project:bufferlist:*:*:*:*:*:node.js:*:*
- Bufferlist Project » Bufferlist » For Node.jsVersions from including (>=) 3.0.0 and before (<) 3.0.1cpe:2.3:a:bufferlist_project:bufferlist:*:*:*:*:*:node.js:*:*
Exploit prediction scoring system (EPSS) score for CVE-2020-8244
0.37%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 58 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2020-8244
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
6.4
|
MEDIUM | AV:N/AC:L/Au:N/C:P/I:N/A:P |
10.0
|
4.9
|
NIST | |
|
6.5
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L |
3.9
|
2.5
|
NIST |
CWE ids for CVE-2020-8244
-
The product reads data past the end, or before the beginning, of the intended buffer.Assigned by: nvd@nist.gov (Primary)
-
The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.Assigned by: support@hackerone.com (Secondary)
References for CVE-2020-8244
-
https://hackerone.com/reports/966347
HackerOneExploit;Patch;Third Party Advisory
-
https://lists.debian.org/debian-lts-announce/2021/06/msg00028.html
[SECURITY] [DLA 2698-1] node-bl security updateMailing List;Third Party Advisory
Jump to