CVE-2020-24349

Опубликовано: 13 авг. 2020

Источник: nvd

CVSS3: 5.5

CVSS2: 2.1

EPSS Низкий

Описание

njs through 0.4.3, used in NGINX, allows control-flow hijack in njs_value_property in njs_value.c. NOTE: the vendor considers the issue to be "fluff" in the NGINX use case because there is no remote attack surface.

Ссылки

https://cwe.mitre.org/data/definitions/416.html
Third Party Advisory
https://github.com/nginx/njs/issues/324
Exploit
Issue Tracking
Patch
Third Party Advisory
https://security.netapp.com/advisory/ntap-20200918-0001/
Third Party Advisory
https://cwe.mitre.org/data/definitions/416.html
Third Party Advisory
https://github.com/nginx/njs/issues/324
Exploit
Issue Tracking
Patch
Third Party Advisory
https://security.netapp.com/advisory/ntap-20200918-0001/
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:f5:njs:*:*:*:*:*:*:*:*

Версия до 0.4.3 (включая)

EPSS

Процентиль: 18%

0.00057

Низкий

5.5 Medium

CVSS3

2.1 Low

CVSS2

Дефекты

CWE-416

Связанные уязвимости

GHSA-gv5c-89fp-pfpj