CVE-2020-7752

Description

This affects the package systeminformation before 4.27.11. This package is vulnerable to Command Injection. The attacker can concatenate curl's parameters to overwrite Javascript files and then execute any OS commands.

References

https://github.com/advisories/GHSA-94xh-2fmc-xf5j

https://snyk.io/vuln/SNYK-JS-SYSTEMINFORMATION-1021909

https://github.com/sebhildebrandt/systeminformation/commit/931fecaec2c1a7dcc10457bb8cd552d08089da61

https://github.com/sebhildebrandt/systeminformation/blob/master/lib/internet.js

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

EPSS