Login Request a demo
High severity · published Aug 30, 2020
CVE-2020-7712
Command Injection
7.2
CVSS
3.1%
EPSS
No
On KEV
Description
This affects the package json before 10.0.0. It is possible to inject arbritary commands using the parseLookup function.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.1% · higher than 88% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JS
json ·
before 10.0.0 · source: vendor, NVD
CG
Commerce Guided Search · Oracle
11.3.2 · source: NVD
FS
Financial Services Crime And Compliance Management Studio · Oracle
8.0.8.2.0; 8.0.8.3.0 · source: NVD
FS
Financial Services Regulatory Reporting With Agilereporter · Oracle
8.0.9.6.3 · source: NVD
TI
Timesten In-memory Database · Oracle
before 21.1.1.1.0 · source: NVD
Affected product
JS
json
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-7712
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-7712
Exploit
https://github.com/trentm/json/issues/144
Patch
https://github.com/trentm/json/pull/145
lists.apache.org
https://lists.apache.org/thread.html/r37c0e1807da7ff2bdd028bbe296465a6bbb99e2320dbe661d5d8b33b%40%3Cissues.zookeeper.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/r3b04f4e99a19613f88ae088aa18cd271231a3c79dfff8f5efa8cda61%40%3Cissues.zookeeper.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/r5f17bfca1d6e7f4b33ae978725b2fd62a9f1b3111696eafa9add802d%40%3Cissues.zookeeper.apache.org%3E
lists.apache.org
https://lists.apache.org/thread.html/r8d2e174230f6d26e16c007546e804c343f1f68956f526daaafa4aaae%40%3Cdev.zookeeper.apache.org%3E