CVE-2020-7788

HIGH
New! CVE Severity Now Using CVSS v3

The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Description

This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.

References

https://snyk.io/vuln/SNYK-JS-INI-1048974

https://github.com/npm/ini/commit/56d2805e07ccd94e2ba0984ac9240ff02d44b6f1

https://lists.debian.org/debian-lts-announce/2020/12/msg00032.html

Details

Source: MITRE

Published: 2020-12-11

Updated: 2021-07-21

Type: CWE-400

Risk Information

CVSS v2

Base Score: 7.5

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Impact Score: 6.4

Exploitability Score: 10

Severity: HIGH

CVSS v3

Base Score: 7.3

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Impact Score: 3.4

Exploitability Score: 3.9

Severity: HIGH

Tenable Plugins

View all (10 total)

IDNameProductFamilySeverity
146539CentOS 8 : nodejs:12 (CESA-2021:0549)NessusCentOS Local Security Checks
high
146802CentOS 8 : nodejs:10 (CESA-2021:0548)NessusCentOS Local Security Checks
high
146638Oracle Linux 8 : nodejs:10 (ELSA-2021-0548)NessusOracle Linux Local Security Checks
high
146637Oracle Linux 8 : nodejs:14 (ELSA-2021-0551)NessusOracle Linux Local Security Checks
high
146636Oracle Linux 8 : nodejs:12 (ELSA-2021-0549)NessusOracle Linux Local Security Checks
high
146548CentOS 8 : nodejs:14 (CESA-2021:0551)NessusCentOS Local Security Checks
high
146547RHEL 8 : nodejs:10 (RHSA-2021:0548)NessusRed Hat Local Security Checks
high
146540RHEL 8 : nodejs:14 (RHSA-2021:0551)NessusRed Hat Local Security Checks
high
146536RHEL 8 : nodejs:12 (RHSA-2021:0549)NessusRed Hat Local Security Checks
high
144541Debian DLA-2503-1 : node-ini security updateNessusDebian Local Security Checks
high