CVE-2020-24807

Опубликовано: 06 окт. 2020

Источник: nvd

CVSS3: 7.8

CVSS2: 6.8

EPSS Низкий

Описание

The socket.io-file package through 2.0.31 for Node.js relies on client-side validation of file types, which allows remote attackers to execute arbitrary code by uploading an executable file via a modified JSON name field. NOTE: This vulnerability only affects products that are no longer supported by the maintainer

Ссылки

https://github.com/advisories/GHSA-6495-8jvh-f28x
Third Party Advisory
https://github.com/rico345100/socket.io-file
Product
Third Party Advisory
https://www.npmjs.com/advisories/1564
Third Party Advisory
https://www.npmjs.com/package/socket.io-file
Product
Third Party Advisory
https://github.com/advisories/GHSA-6495-8jvh-f28x
Third Party Advisory
https://github.com/rico345100/socket.io-file
Product
Third Party Advisory
https://www.npmjs.com/advisories/1564
Third Party Advisory
https://www.npmjs.com/package/socket.io-file
Product
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:socket.io-file_project:socket.io-file:*:*:*:*:*:node.js:*:*

Версия до 2.0.31 (включая)

EPSS

Процентиль: 70%

0.00654

Низкий

7.8 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-20

Связанные уязвимости

GHSA-6495-8jvh-f28x