CVE-2020-7677
Arbitrary Code Execution
- State
- Published
- Severity
- 8.6 High
- Published
- Jul 25, 2022
- Updated
- Sep 16, 2024
- Reserved
- Jan 21, 2020
Description
This affects the package thenify before 3.3.1. The name argument provided to the package can be controlled by users without any sanitization, and this is provided to the eval function without any sanitization.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 8.6 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:U/RC:C | snyk |
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
thenifyn/a |
|
References
- https://security.snyk.io/vuln/SNYK-JS-THENIFY-571690
- https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-572317
- https://github.com/thenables/thenify/blob/master/index.js%23L17
- https://github.com/thenables/thenify/commit/0d94a24eb933bc835d568f3009f4d269c4c4c17a
- [debian-lts-announce] 20220930 [SECURITY] [DLA 3128-1] node-thenify security updatemailing-list
- FEDORA-2023-ce8943223cvendor-advisory
- FEDORA-2023-18fd476362vendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.