CVE-2020-7778
CVE-2020-7778 · Prototype Pollution
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
This affects the package systeminformation before 4.30.2. The attacker can overwrite the properties and functions of an object, which can lead to executing OS commands.
CVSS 7.3 · Alta · EPSS 2,4% · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: node
Productos y versiones afectados
systeminformation
- Versiones
- ≥ unspecified, < 4.30.2: Afectada (custom)
Actualiza a 4.30.2
systeminformation npm
- Intervalos de versiones afectados
- SEMVER: < 4.30.2
Actualiza a 4.30.2
Fuentes originales
- https://github.com/sebhildebrandt/systeminformation/blob/master/lib/internet.js
- https://snyk.io/vuln/SNYK-JS-SYSTEMINFORMATION-1043753
- https://gist.github.com/EffectRenan/b434438938eed0b21b376cedf5c81e80
- https://github.com/sebhildebrandt/systeminformation/commit/73dce8d717ca9c3b7b0d0688254b8213b957f0fa%23diff-970ae648187190f86bafc8f193b7538200eba164fad0674428b6487582c089cc
- https://github.com/sebhildebrandt/systeminformation/commit/11103a447ab9550c25f1fbec7e6d903720b3fea8%23diff-970ae648187190f86bafc8f193b7538200eba164fad0674428b6487582c089cc
- https://nvd.nist.gov/vuln/detail/CVE-2020-7778