OS Command Injection in systeminformation
This affects the package systeminformation before 4.30.2. The attacker can overwrite the properties and functions of an object, which can lead to executing OS commands.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2020-7778US | high7.5 | — | ||
This affects the package systeminformation before 4.30.2. The attacker can overwrite the properties and functions of an object, which can lead to executing OS commands. | ||||
02
references
External citations — patches, advisories, analysis.
- https://gist.github.com/EffectRenan/b434438938eed0b21b376cedf5c81e80WEB
- https://github.com/sebhildebrandt/systeminformation/blob/master/lib/internet.jsWEB
- https://github.com/sebhildebrandt/systeminformation/commit/11103a447ab9550c25f1fbec7e6d903720b3fea8%23diff-970ae648187190f86bafc8f193b7538200eba164fad0674428b6487582c089ccWEB
- https://github.com/sebhildebrandt/systeminformation/commit/73dce8d717ca9c3b7b0d0688254b8213b957f0fa%23diff-970ae648187190f86bafc8f193b7538200eba164fad0674428b6487582c089ccWEB
- https://nvd.nist.gov/vuln/detail/CVE-2020-7778ADVISORY
- https://snyk.io/vuln/SNYK-JS-SYSTEMINFORMATION-1043753WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan