Critical severity · published Jul 30, 2020
CVE-2020-7699
This affects the package express-fileupload before 1.1.8
9.8
CVSS
4.8%
EPSS
No
On KEV
Description
This affects the package express-fileupload before 1.1.8. If the parseNested option is enabled, sending a corrupt HTTP request can lead to denial of service or arbitrary code execution.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)4.8% · higher than 92% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EX
Express-fileupload · Express-fileupload Project
before 1.1.8 · source: NVD
MD
Max Data · Netapp
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-7699
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-7699
Exploit
https://github.com/richardgirges/express-fileupload/issues/236
Third Party Advisory
https://security.netapp.com/advisory/ntap-20200821-0003/
Exploit
https://snyk.io/vuln/SNYK-JS-EXPRESSFILEUPLOAD-595969
More from Express-fileupload
9.8
CVE-2022-27140
An arbitrary file upload vulnerability in the file upload module of express-fileupload 1.3.1 allows attackers to execute arbitrary code via a crafted PHP file
7.5
CVE-2022-27261
An arbitrary file write vulnerability in Express-FileUpload v1.3.1 allows attackers to upload multiple files with the same name, causing an overwrite of files in the web…