Vulnerability Description
This affects all versions of package node-pdf-generator. Due to lack of user input validation and sanitization done to the content given to node-pdf-generator, it is possible for an attacker to craft a url that will be passed to an external server allowing an SSRF attack.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Node-Pdf-Generator Project | Node-Pdf-Generator | All versions |
Related Weaknesses (CWE)
References
- https://github.com/darrenhaken/node-pdf-generator/blob/master/index.js%23L29Broken LinkThird Party Advisory
- https://snyk.io/vuln/SNYK-JS-NODEPDFGENERATOR-609636Third Party Advisory
- https://github.com/darrenhaken/node-pdf-generator/blob/master/index.js%23L29Broken LinkThird Party Advisory
- https://snyk.io/vuln/SNYK-JS-NODEPDFGENERATOR-609636Third Party Advisory
FAQ
What is CVE-2020-7740?
CVE-2020-7740 is a vulnerability with a CVSS score of 8.2 (HIGH). This affects all versions of package node-pdf-generator. Due to lack of user input validation and sanitization done to the content given to node-pdf-generator, it is possible for an attacker to craft ...
How severe is CVE-2020-7740?
CVE-2020-7740 has been rated HIGH with a CVSS base score of 8.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-7740?
Check the references section above for vendor advisories and patch information. Affected products include: Node-Pdf-Generator Project Node-Pdf-Generator.