CVE-2020-13756

Опубликовано: 03 июн. 2020

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Средний

Описание

Sabberworm PHP CSS Parser before 8.3.1 calls eval on uncontrolled data, possibly leading to remote code execution if the function allSelectors() or getSelectorsBySpecificity() is called with input from an attacker.

Ссылки

http://packetstormsecurity.com/files/157923/Sabberworm-PHP-CSS-Code-Injection.html
Exploit
Third Party Advisory
VDB Entry
http://seclists.org/fulldisclosure/2020/Jun/7
Exploit
Mailing List
Third Party Advisory
https://github.com/sabberworm/PHP-CSS-Parser/commit/2ebf59e8bfbf6cfc1653a5f0ed743b95062c62a4
Patch
Third Party Advisory
https://github.com/sabberworm/PHP-CSS-Parser/releases/tag/8.3.1
Release Notes
Third Party Advisory
http://packetstormsecurity.com/files/157923/Sabberworm-PHP-CSS-Code-Injection.html
Exploit
Third Party Advisory
VDB Entry
http://seclists.org/fulldisclosure/2020/Jun/7
Exploit
Mailing List
Third Party Advisory
https://github.com/sabberworm/PHP-CSS-Parser/commit/2ebf59e8bfbf6cfc1653a5f0ed743b95062c62a4
Patch
Third Party Advisory
https://github.com/sabberworm/PHP-CSS-Parser/releases/tag/8.3.1
Release Notes
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2025/10/msg00013.html

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:sabberworm:php_css_parser:*:*:*:*:*:*:*:*

Версия до 8.3.1 (исключая)

EPSS

Процентиль: 96%

0.21413

Средний

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-94

Связанные уязвимости

CVE-2020-13756

CVSS3: 9.8

ubuntu

больше 5 лет назад

CVE-2020-13756

CVSS3: 9.8

debian

больше 5 лет назад

Sabberworm PHP CSS Parser before 8.3.1 calls eval on uncontrolled data ...

GHSA-phrq-v4q2-hmq6

CVSS3: 9.8

github

почти 4 года назад

Sabberworm PHP CSS Parser Code injection vulnerability in allSelectors()

EPSS

Процентиль: 96%

0.21413

Средний

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-94