Lucene search

SnykCVELIST:CVE-2020-7795

HistoryAug 02, 2022 - 12:00 a.m.

CVE-2020-7795 Command Injection

2022-08-0200:00:00

snyk

www.cve.org

7.3 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P

9.7 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

54.9%

JSON

The package get-npm-package-version before 1.0.7 are vulnerable to Command Injection via main function in index.js.

CNA Affected

[
  {
    "product": "get-npm-package-version",
    "vendor": "n/a",
    "versions": [
      {
        "lessThan": "1.0.7",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

github.com/hoperyy/get-npm-package-version/blob/338a5882298eb2c2194538db41166cae13c39e03/index.js%23L17

github.com/hoperyy/get-npm-package-version/commit/40b1cf31a0607ea66f9e30a0c3af1383b52b2dec

security.snyk.io/vuln/SNYK-JS-GETNPMPACKAGEVERSION-1050390

www.npmjs.com/package/get-npm-package-version/v/1.0.6

7.3 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P

9.7 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

54.9%

JSON

Related for CVELIST:CVE-2020-7795