OS Command Injection in systeminformation
This affects the package systeminformation before 4.30.2. The attacker can overwrite the properties and functions of an object, which can lead to executing OS commands.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2020-7778US | high7.5 | — | ||
This affects the package systeminformation before 4.30.2. The attacker can overwrite the properties and functions of an object, which can lead to executing OS commands. | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://gist.github.com/EffectRenan/b434438938eed0b21b376cedf5c81e80WEB
- https://github.com/sebhildebrandt/systeminformation/blob/master/lib/internet.jsWEB
- https://github.com/sebhildebrandt/systeminformation/commit/11103a447ab9550c25f1fbec7e6d903720b3fea8%23diff-970ae648187190f86bafc8f193b7538200eba164fad0674428b6487582c089ccWEB
- https://github.com/sebhildebrandt/systeminformation/commit/73dce8d717ca9c3b7b0d0688254b8213b957f0fa%23diff-970ae648187190f86bafc8f193b7538200eba164fad0674428b6487582c089ccWEB
- https://nvd.nist.gov/vuln/detail/CVE-2020-7778ADVISORY
- https://snyk.io/vuln/SNYK-JS-SYSTEMINFORMATION-1043753WEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan