CVE-2020-8298

Опубликовано: 04 мар. 2021

Источник: nvd

CVSS3: 9.8

CVSS2: 10

EPSS Низкий

Описание

fs-path node module before 0.0.25 is vulnerable to command injection by way of user-supplied inputs via the copy, copySync, remove, and removeSync methods.

Ссылки

https://github.com/pillys/fs-path/commit/88ff5ee51046bb2c5d5e9c5afe6819b032092ce7
Patch
Third Party Advisory
https://github.com/pillys/fs-path/pull/6
Exploit
Patch
Third Party Advisory
https://hackerone.com/reports/324491
Exploit
Issue Tracking
Patch
Third Party Advisory
https://github.com/pillys/fs-path/commit/88ff5ee51046bb2c5d5e9c5afe6819b032092ce7
Patch
Third Party Advisory
https://github.com/pillys/fs-path/pull/6
Exploit
Patch
Third Party Advisory
https://hackerone.com/reports/324491
Exploit
Issue Tracking
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:fs-path_project:fs-path:*:*:*:*:*:node.js:*:*

Версия до 0.0.25 (исключая)

EPSS

Процентиль: 88%

0.04178

Низкий

9.8 Critical

CVSS3

10 Critical

CVSS2

Дефекты

CWE-77

Связанные уязвимости

GHSA-8mrf-64fw-2x75