{"id":"CVE-2020-7778","published":"2020-11-26T10:40:14Z","modified":"2024-09-16T20:53:12Z","title":"Prototype Pollution","vendor":null,"product":null,"tier":"tail","description":{"text":"This affects the package systeminformation before 4.30.2. The attacker can overwrite the properties and functions of an object, which can lead to executing OS commands.","provenance":"source","from":"CVE.org"},"cvss":{"score":7.3,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.02422,"percentile":0.84141,"provenance":"source"},"cwes":[],"references":[{"url":"https://github.com/sebhildebrandt/systeminformation/blob/master/lib/internet.js","tags":["x_refsource_MISC"]},{"url":"https://snyk.io/vuln/SNYK-JS-SYSTEMINFORMATION-1043753","tags":["x_refsource_MISC"]},{"url":"https://gist.github.com/EffectRenan/b434438938eed0b21b376cedf5c81e80","tags":["x_refsource_MISC"]},{"url":"https://github.com/sebhildebrandt/systeminformation/commit/73dce8d717ca9c3b7b0d0688254b8213b957f0fa%23diff-970ae648187190f86bafc8f193b7538200eba164fad0674428b6487582c089cc","tags":["x_refsource_MISC"]},{"url":"https://github.com/sebhildebrandt/systeminformation/commit/11103a447ab9550c25f1fbec7e6d903720b3fea8%23diff-970ae648187190f86bafc8f193b7538200eba164fad0674428b6487582c089cc","tags":["x_refsource_MISC"]}],"priority":{"score":21.9,"factors":[{"name":"EPSS percentile","points":16.83},{"name":"CVSS severity","points":5.11}]},"affectedVersions":[{"vendor":"n/a","product":"systeminformation","versions":[">= unspecified, < 4.30.2"]}],"affected":[{"ecosystem":"npm","package":"systeminformation","vulnerableRanges":["<4.30.2"],"patched":["4.30.2"],"from":["GHSA-8j36-q8x7-pm6q"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-0919","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-sebhildebrandt-systeminformation-cve-2020-7752","parents":[{"from":"CVE-2020-7752","to":"CVE-2020-7778","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"npm:systeminformation","fromFixed":"4.27.11","toFixed":"4.30.2","daysApart":31},{"kind":"same-code","provenance":"machine","files":["lib/internet.js"],"commits":["https://github.com/sebhildebrandt/systeminformation/commit/931fecaec2c1a7dcc10457bb8cd552d08089da61","https://github.com/sebhildebrandt/systeminformation/commit/73dce8d717ca9c3b7b0d0688254b8213b957f0fa","https://github.com/sebhildebrandt/systeminformation/commit/11103a447ab9550c25f1fbec7e6d903720b3fea8"],"basis":"shared function","functions":["inetChecksite"]}]}],"children":[{"from":"CVE-2020-7778","to":"CVE-2020-26245","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"npm:systeminformation","fromFixed":"4.30.2","toFixed":"4.30.5","daysApart":1},{"kind":"same-code","provenance":"machine","files":["lib/internet.js","lib/network.js","lib/processes.js","lib/util.js"],"commits":["https://github.com/sebhildebrandt/systeminformation/commit/8113ff0e87b2f422a5756c48f1057575e73af016","https://github.com/sebhildebrandt/systeminformation/commit/73dce8d717ca9c3b7b0d0688254b8213b957f0fa","https://github.com/sebhildebrandt/systeminformation/commit/11103a447ab9550c25f1fbec7e6d903720b3fea8"],"basis":"shared function","functions":["inetChecksite","isPrototypePolluted","networkStatsSingle","services"]}]},{"from":"CVE-2020-7778","to":"CVE-2020-26274","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["lib/util.js"],"commits":["https://github.com/sebhildebrandt/systeminformation/commit/1faadcbf68f1b1fdd5eb2054f68fc932be32ac99","https://github.com/sebhildebrandt/systeminformation/commit/73dce8d717ca9c3b7b0d0688254b8213b957f0fa","https://github.com/sebhildebrandt/systeminformation/commit/11103a447ab9550c25f1fbec7e6d903720b3fea8"],"basis":"shared function","functions":["sanitizeShellString"]}]},{"from":"CVE-2020-7778","to":"CVE-2021-21315","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["lib/internet.js","lib/network.js","lib/processes.js"],"commits":["https://github.com/sebhildebrandt/systeminformation/commit/73dce8d717ca9c3b7b0d0688254b8213b957f0fa","https://github.com/sebhildebrandt/systeminformation/commit/11103a447ab9550c25f1fbec7e6d903720b3fea8","https://github.com/sebhildebrandt/systeminformation/commit/07daa05fb06f24f96297abaa30c2ace8bfd8b525"],"basis":"shared function","functions":["inetChecksite","inetLatency","processLoad","services"]}]},{"from":"CVE-2020-7778","to":"CVE-2021-21388","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["lib/internet.js","lib/network.js","lib/processes.js"],"commits":["https://github.com/sebhildebrandt/systeminformation/commit/73dce8d717ca9c3b7b0d0688254b8213b957f0fa","https://github.com/sebhildebrandt/systeminformation/commit/11103a447ab9550c25f1fbec7e6d903720b3fea8","https://github.com/sebhildebrandt/systeminformation/commit/01ef56cd5824ed6da1c11b37013a027fdef67524","https://github.com/sebhildebrandt/systeminformation/commit/0be6fcd575c05687d1076d5cd6d75af2ebae5a46"],"basis":"shared function","functions":["inetChecksite","inetLatency","networkStatsSingle","processLoad","services"]}]}],"packageHistory":[{"cve":"CVE-2020-26300","published":"2021-09-09","fixed":"4.26.2","kev":false},{"cve":"CVE-2020-7752","published":"2020-10-26","fixed":"4.27.11","kev":false},{"cve":"CVE-2020-7778","published":"2020-11-26","fixed":"4.30.2","kev":false},{"cve":"CVE-2020-26245","published":"2020-11-27","fixed":"4.30.5","kev":false},{"cve":"CVE-2020-26274","published":"2020-12-16","fixed":"4.31.1","kev":false},{"cve":"CVE-2021-21315","published":"2021-02-16","fixed":"5.3.1","kev":true}],"package":"npm:systeminformation"}}