CVE-2020-7678 — HIGH (8.6) — White Hats Nepal

Vulnerability Description

This affects all versions of package node-import. The "params" argument of module function can be controlled by users without any sanitization.b. This is then provided to the “eval” function located in line 79 in the index file "index.js".

CVSS Score

8.6

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

LOW

Availability

LOW

Affected Products

Vendor	Product	Versions
Node-Import Project	Node-Import	All versions

References

https://github.com/mahdaen/node-import/blob/master/index.js%23L79Broken LinkThird Party Advisory
https://security.snyk.io/vuln/SNYK-JS-NODEIMPORT-571691ExploitThird Party Advisory
https://github.com/mahdaen/node-import/blob/master/index.js%23L79Broken LinkThird Party Advisory
https://security.snyk.io/vuln/SNYK-JS-NODEIMPORT-571691ExploitThird Party Advisory

FAQ

What is CVE-2020-7678?

CVE-2020-7678 is a vulnerability with a CVSS score of 8.6 (HIGH). This affects all versions of package node-import. The "params" argument of module function can be controlled by users without any sanitization.b. This is then provided to the “eval” function located i...

How severe is CVE-2020-7678?

CVE-2020-7678 has been rated HIGH with a CVSS base score of 8.6/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2020-7678?

Check the references section above for vendor advisories and patch information. Affected products include: Node-Import Project Node-Import.