CVE-2020-7752

CVE-2020-7752 · Command Injection

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This affects the package systeminformation before 4.27.11. This package is vulnerable to Command Injection. The attacker can concatenate curl's parameters to overwrite Javascript files and then execute any OS commands.

CVSS 8.8 · High · EPSS 6.7% · Fix available

Published: 2020-10-26T17:12:38.827Z
Updated: 2024-09-17T01:56:58.841Z

Stack: node

Affected products and versions

systeminformation
Versions
- ≥ unspecified, < 4.27.11: Affected (custom)
Update to 4.27.11
systeminformation npm
Affected ranges
- SEMVER: < 4.27.11
Update to 4.27.11

Original sources

https://snyk.io/vuln/SNYK-JS-SYSTEMINFORMATION-1021909
https://github.com/sebhildebrandt/systeminformation/blob/master/lib/internet.js
https://github.com/sebhildebrandt/systeminformation/commit/931fecaec2c1a7dcc10457bb8cd552d08089da61
https://nvd.nist.gov/vuln/detail/CVE-2020-7752

Check your server →

CVE-2020-7752 · Command Injection

Affected products and versions

systeminformation

systeminformation npm

Original sources