{"id":"CVE-2020-7752","published":"2020-10-26T17:12:38Z","modified":"2024-09-17T01:56:58Z","title":"Command Injection","vendor":null,"product":null,"tier":"tail","description":{"text":"This affects the package systeminformation before 4.27.11. This package is vulnerable to Command Injection. The attacker can concatenate curl's parameters to overwrite Javascript files and then execute any OS commands.","provenance":"source","from":"CVE.org"},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.06749,"percentile":0.93949,"provenance":"source"},"cwes":[],"references":[{"url":"https://snyk.io/vuln/SNYK-JS-SYSTEMINFORMATION-1021909","tags":["x_refsource_MISC"]},{"url":"https://github.com/sebhildebrandt/systeminformation/blob/master/lib/internet.js","tags":["x_refsource_MISC"]},{"url":"https://github.com/sebhildebrandt/systeminformation/commit/931fecaec2c1a7dcc10457bb8cd552d08089da61","tags":["x_refsource_MISC"]}],"priority":{"score":24.9,"factors":[{"name":"EPSS percentile","points":18.79},{"name":"CVSS severity","points":6.16}]},"affectedVersions":[{"vendor":"n/a","product":"systeminformation","versions":[">= unspecified, < 4.27.11"]}],"affected":[{"ecosystem":"npm","package":"systeminformation","vulnerableRanges":["<4.27.11"],"patched":["4.27.11"],"from":["GHSA-94xh-2fmc-xf5j"],"provenance":"source"}],"euvd":{"id":"EUVD-2020-1423","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-sebhildebrandt-systeminformation-cve-2020-7752","children":[{"from":"CVE-2020-7752","to":"CVE-2020-7778","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"npm:systeminformation","fromFixed":"4.27.11","toFixed":"4.30.2","daysApart":31},{"kind":"same-code","provenance":"machine","files":["lib/internet.js"],"commits":["https://github.com/sebhildebrandt/systeminformation/commit/931fecaec2c1a7dcc10457bb8cd552d08089da61","https://github.com/sebhildebrandt/systeminformation/commit/73dce8d717ca9c3b7b0d0688254b8213b957f0fa","https://github.com/sebhildebrandt/systeminformation/commit/11103a447ab9550c25f1fbec7e6d903720b3fea8"],"basis":"shared function","functions":["inetChecksite"]}]},{"from":"CVE-2020-7752","to":"CVE-2020-26245","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["lib/internet.js"],"commits":["https://github.com/sebhildebrandt/systeminformation/commit/8113ff0e87b2f422a5756c48f1057575e73af016","https://github.com/sebhildebrandt/systeminformation/commit/931fecaec2c1a7dcc10457bb8cd552d08089da61"],"basis":"shared function","functions":["inetChecksite"]}]},{"from":"CVE-2020-7752","to":"CVE-2021-21315","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["lib/internet.js"],"commits":["https://github.com/sebhildebrandt/systeminformation/commit/931fecaec2c1a7dcc10457bb8cd552d08089da61","https://github.com/sebhildebrandt/systeminformation/commit/07daa05fb06f24f96297abaa30c2ace8bfd8b525"],"basis":"shared function","functions":["inetChecksite"]}]},{"from":"CVE-2020-7752","to":"CVE-2021-21388","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["lib/internet.js"],"commits":["https://github.com/sebhildebrandt/systeminformation/commit/931fecaec2c1a7dcc10457bb8cd552d08089da61","https://github.com/sebhildebrandt/systeminformation/commit/01ef56cd5824ed6da1c11b37013a027fdef67524","https://github.com/sebhildebrandt/systeminformation/commit/0be6fcd575c05687d1076d5cd6d75af2ebae5a46"],"basis":"shared function","functions":["inetChecksite"]}]}],"packageHistory":[{"cve":"CVE-2020-26300","published":"2021-09-09","fixed":"4.26.2","kev":false},{"cve":"CVE-2020-7752","published":"2020-10-26","fixed":"4.27.11","kev":false},{"cve":"CVE-2020-7778","published":"2020-11-26","fixed":"4.30.2","kev":false},{"cve":"CVE-2020-26245","published":"2020-11-27","fixed":"4.30.5","kev":false},{"cve":"CVE-2020-26274","published":"2020-12-16","fixed":"4.31.1","kev":false}],"package":"npm:systeminformation"}}