Lucene search

SnykCVE-2020-7674

HistoryJun 10, 2020 - 4:15 p.m.

CVE-2020-7674

2020-06-1016:15:10

CWE-94

snyk

web.nvd.nist.gov

access-policy

3.1.0

arbitrary code execution

user input

template function

eval function

code execution

cve-2020-7674

nvd

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.6

Confidence

High

EPSS

0.062

Percentile

93.7%

JSON

access-policy through 3.1.0 is vulnerable to Arbitrary Code Execution. User input provided to the template function is executed by the eval function resulting in code execution.

Affected configurations

Nvd

Node

access-policy_projectaccess-policyRange≤3.1.0node.js

VendorProductVersionCPE
access-policy_projectaccess-policy*cpe:2.3:a:access-policy_project:access-policy:*:*:*:*:*:node.js:*:*

Vendor	Product	Version	CPE
access-policy_project	access-policy	*	cpe:2.3:a:access-policy_project:access-policy::::::node.js::*

CNA Affected

[
  {
    "product": "access-policy",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "All versions including 3.1.0"
      }
    ]
  }
]

References

snyk.io/vuln/SNYK-JS-ACCESSPOLICY-571490

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.6

Confidence

High

EPSS

0.062

Percentile

93.7%

JSON

Related for CVE-2020-7674