CVE-2020-7769
Command Injection
- State
- Published
- Severity
- 8.6 High
- Published
- Nov 12, 2020
- Updated
- Sep 16, 2024
- Reserved
- Jan 21, 2020
Description
This affects the package nodemailer before 6.4.16. Use of crafted recipient email addresses may result in arbitrary command flag injection in sendmail transport for sending mails.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 8.6 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H/E:P/RL:U/RC:C | snyk |
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
nodemailern/a |
|
References
- https://snyk.io/vuln/SNYK-JS-NODEMAILER-1038834
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1039742
- https://github.com/nodemailer/nodemailer/blob/33b62e2ea6bc9215c99a9bb4bfba94e2fb27ebd0/lib/sendmail-transport/index.js%23L75
- https://github.com/nodemailer/nodemailer/commit/ba31c64c910d884579875c52d57ac45acc47aa54
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.