Lucene search

GitHub Advisory DatabaseGHSA-4HV7-3Q38-97M8

HistoryApr 13, 2021 - 3:24 p.m.

Arbitrary code execution in djv

2021-04-1315:24:47

CWE-94

GitHub Advisory Database

github.com

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.004 Low

EPSS

Percentile

75.0%

JSON

This affects the package djv before 2.1.4. By controlling the schema file, an attacker can run arbitrary JavaScript code on the victim machine.

Affected configurations

Vulners

Node

djv_projectdjvRange<2.1.4node.js

CPENameOperatorVersion
djvlt2.1.4

CPE	Name	Operator	Version
	djv	lt	2.1.4

References

github.com/advisories/GHSA-4hv7-3q38-97m8

github.com/korzio/djv/blob/master/lib/utils/properties.js%23L55

github.com/korzio/djv/pull/98/files

nvd.nist.gov/vuln/detail/CVE-2020-28464

snyk.io/vuln/SNYK-JS-DJV-1014545

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.004 Low

EPSS

Percentile

75.0%

JSON

Related for GHSA-4HV7-3Q38-97M8