CVE-2020-8131

Опубликовано: 24 фев. 2020

Источник: nvd

CVSS3: 7.5

CVSS2: 5.1

EPSS Низкий

Описание

Arbitrary filesystem write vulnerability in Yarn before 1.22.0 allows attackers to write to any path on the filesystem and potentially lead to arbitrary code execution by forcing the user to install a malicious package.

Ссылки

https://github.com/yarnpkg/yarn/pull/7831
Patch
Third Party Advisory
https://hackerone.com/reports/730239
Exploit
Third Party Advisory
https://github.com/yarnpkg/yarn/pull/7831
Patch
Third Party Advisory
https://hackerone.com/reports/730239
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:yarnpkg:yarn:*:*:*:*:*:*:*:*

Версия до 1.21.1 (включая)

EPSS

Процентиль: 75%

0.00897

Низкий

7.5 High

CVSS3

5.1 Medium

CVSS2

Дефекты

CWE-22

Связанные уязвимости

CVE-2020-8131

CVSS3: 7.5

ubuntu

почти 6 лет назад

CVE-2020-8131

CVSS3: 7.5

redhat

почти 6 лет назад

CVE-2020-8131

CVSS3: 7.5

debian

почти 6 лет назад

Arbitrary filesystem write vulnerability in Yarn before 1.22.0 allows ...

GHSA-8mfc-v7wv-p62g

CVSS3: 7.5

github

почти 4 года назад

Path Traversal in Yarn

EPSS

Процентиль: 75%

0.00897

Низкий

7.5 High

CVSS3

5.1 Medium

CVSS2

Дефекты

CWE-22