CVE-2020-26207 Unsafe deserialization in DatabaseSchemaViewer

2020-11-0422:00:17

CWE-502

GitHub_M

www.cve.org

cve-2020-26207

databaseschemaviewer

arbitrary code execution

.dbschema

untrusted sources

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

EPSS

0.002

Percentile

61.1%

JSON

DatabaseSchemaViewer before version 2.7.4.3 is vulnerable to arbitrary code execution if a user is tricked into opening a specially crafted .dbschema file. The patch was released in v2.7.4.3. As a workaround, ensure .dbschema files from untrusted sources are not opened.

CNA Affected

[
  {
    "product": "dbschemareader",
    "vendor": "martinjw",
    "versions": [
      {
        "status": "affected",
        "version": "< 2.7.4.3"
      }
    ]
  }
]