CVE-2020-8141

Опубликовано: 15 мар. 2020

Источник: nvd

CVSS3: 8.8

CVSS2: 6.5

EPSS Низкий

Описание

The dot package v1.1.2 uses Function() to compile templates. This can be exploited by the attacker if they can control the given template or if they can control the value set on Object.prototype.

Ссылки

https://hackerone.com/reports/390929
Exploit
Mitigation
Third Party Advisory
https://hackerone.com/reports/390929
Exploit
Mitigation
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:dot_project:dot:1.1.2:*:*:*:*:node.js:*:*

EPSS

Процентиль: 77%

0.01037

Низкий

8.8 High

CVSS3

6.5 Medium

CVSS2

Дефекты

CWE-94

Связанные уязвимости

CVE-2020-8141

CVSS3: 8.8

ubuntu

почти 6 лет назад

The dot package v1.1.2 uses Function() to compile templates. This can be exploited by the attacker if they can control the given template or if they can control the value set on Object.prototype.

CVE-2020-8141

CVSS3: 8.8

debian

почти 6 лет назад

The dot package v1.1.2 uses Function() to compile templates. This can ...

GHSA-297x-8xj4-vcxv

CVSS3: 8.8

github

больше 3 лет назад

Improper Control of Generation of Code in doT

EPSS

Процентиль: 77%

0.01037

Низкий

8.8 High

CVSS3

6.5 Medium

CVSS2

Дефекты

CWE-94