CVE-2020-7677

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2020-7677
This affects the package thenify before 3.3.1. The name argument provided to the package can be controlled by users without any sanitization, and this is provided to the eval function without any sanitization.

8.6 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 4.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://github.com/thenables/thenify/blob/master/index.js%23L17 Broken Link
https://github.com/thenables/thenify/commit/0d94a24eb933bc835d568f3009f4d269c4c4c17a Patch
https://lists.debian.org/debian-lts-announce/2022/09/msg00039.html Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MTEUUTNIEBHGKUKKLNUZSV7IEP6IP3Q3/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UM6XJ73Q3NAM5KSGCOKJ2ZIA6GUWUJLK/
https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-572317 Exploit Third Party Advisory
https://security.snyk.io/vuln/SNYK-JS-THENIFY-571690 Exploit Third Party Advisory
https://github.com/thenables/thenify/blob/master/index.js%23L17 Broken Link
https://github.com/thenables/thenify/commit/0d94a24eb933bc835d568f3009f4d269c4c4c17a Patch
https://lists.debian.org/debian-lts-announce/2022/09/msg00039.html Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MTEUUTNIEBHGKUKKLNUZSV7IEP6IP3Q3/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UM6XJ73Q3NAM5KSGCOKJ2ZIA6GUWUJLK/
https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-572317 Exploit Third Party Advisory
https://security.snyk.io/vuln/SNYK-JS-THENIFY-571690 Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:thenify_project:thenify:*:*:*:*:*:node.js:*:*

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
History

21 Nov 2024, 05:37

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 9.8 		v2 : unknown
v3 : 8.6
References () https://github.com/thenables/thenify/blob/master/index.js%23L17 - Broken Link () https://github.com/thenables/thenify/blob/master/index.js%23L17 - Broken Link
References () https://github.com/thenables/thenify/commit/0d94a24eb933bc835d568f3009f4d269c4c4c17a - Patch () https://github.com/thenables/thenify/commit/0d94a24eb933bc835d568f3009f4d269c4c4c17a - Patch
References () https://lists.debian.org/debian-lts-announce/2022/09/msg00039.html - Mailing List, Third Party Advisory () https://lists.debian.org/debian-lts-announce/2022/09/msg00039.html - Mailing List, Third Party Advisory
References () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MTEUUTNIEBHGKUKKLNUZSV7IEP6IP3Q3/ - () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MTEUUTNIEBHGKUKKLNUZSV7IEP6IP3Q3/ -
References () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UM6XJ73Q3NAM5KSGCOKJ2ZIA6GUWUJLK/ - () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UM6XJ73Q3NAM5KSGCOKJ2ZIA6GUWUJLK/ -
References () https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-572317 - Exploit, Third Party Advisory () https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-572317 - Exploit, Third Party Advisory
References () https://security.snyk.io/vuln/SNYK-JS-THENIFY-571690 - Exploit, Third Party Advisory () https://security.snyk.io/vuln/SNYK-JS-THENIFY-571690 - Exploit, Third Party Advisory

23 Feb 2023, 16:21

Type Values Removed Values Added
CPE cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
References
  • (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UM6XJ73Q3NAM5KSGCOKJ2ZIA6GUWUJLK/ - Mailing List, Third Party Advisory
  • (MLIST) https://lists.debian.org/debian-lts-announce/2022/09/msg00039.html - Mailing List, Third Party Advisory
  • (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MTEUUTNIEBHGKUKKLNUZSV7IEP6IP3Q3/ - Mailing List, Third Party Advisory

01 Aug 2022, 17:22

Type Values Removed Values Added
CWE NVD-CWE-noinfo
References (CONFIRM) https://github.com/thenables/thenify/commit/0d94a24eb933bc835d568f3009f4d269c4c4c17a - (CONFIRM) https://github.com/thenables/thenify/commit/0d94a24eb933bc835d568f3009f4d269c4c4c17a - Patch, Third Party Advisory
References (CONFIRM) https://github.com/thenables/thenify/blob/master/index.js%23L17 - (CONFIRM) https://github.com/thenables/thenify/blob/master/index.js%23L17 - Broken Link, Third Party Advisory
References (CONFIRM) https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-572317 - (CONFIRM) https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-572317 - Exploit, Third Party Advisory
References (CONFIRM) https://security.snyk.io/vuln/SNYK-JS-THENIFY-571690 - (CONFIRM) https://security.snyk.io/vuln/SNYK-JS-THENIFY-571690 - Exploit, Third Party Advisory
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.8
CPE cpe:2.3:a:thenify_project:thenify:*:*:*:*:*:node.js:*:*

25 Jul 2022, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2022-07-25 14:15

Updated : 2024-11-21 05:37

NVD link : CVE-2020-7677

Mitre link : CVE-2020-7677

CVE.ORG link : CVE-2020-7677

JSON object : View

Products Affected

debian

  • debian_linux

fedoraproject

  • fedora

thenify_project

  • thenify
CWE
NVD-CWE-noinfo