Nette versions before 2.0.19, 2.1.13, 2.2.10, 2.3.14, 2.4.16, 3.0.6 are vulnerable to an code injection attack by passing specially formed parameters to URL that may possibly leading to RCE. Nette is a PHP/Composer MVC Framework.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Nette versions before 2.0.19, 2.1.13, 2.2.10, 2.3.14, 2.4.16, 3.0.6 are vulnerable to an code injection
    attack by passing specially formed parameters to URL that may possibly leading to RCE. Nette is a
    PHP/Composer MVC Framework. (CVE-2020-15227)

The remote Ubuntu 16.04 ESM / 18.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-5983-1 advisory.

    Cyku Hong discovered that Nette was not properly handling and validating data used for code generation. A     remote attacker could possibly use this issue to execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Cyku Hong from DEVCORE discovered that php-nette, a PHP MVC framework, is vulnerable to a code injection attack by passing specially formed parameters to URL that may possibly leading to remote code execution.

For Debian 9 stretch, this problem has been fixed in version 2.4-20160731-1+deb9u1.

We recommend that you upgrade your php-nette packages.

For the detailed security status of php-nette please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/php-nette

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Type	Severity
412667	SCA: security update for nette/application (GHSA-8gv3-3j7f-wg94)	Tenable Cloud Security	SCA Checks	Local	critical
412667	SCA: security update for nette/application (GHSA-8gv3-3j7f-wg94)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical
173653	Ubuntu 16.04 ESM / 18.04 LTS : Nette vulnerability (USN-5983-1)	Nessus	Ubuntu Local Security Checks	Local	critical
148311	Debian DLA-2617-1 : php-nette security update	Nessus	Debian Local Security Checks	Local	critical

Detections

Analytics

CVE-2020-15227

critical

Tenable Plugins

critical

critical

critical

critical