VDB
CVE-2020-7677
CVE-2020-7677
PUBLISHED
CVSS 8.600000381469727 HIGH
This affects the package thenify before 3.3.1. The name argument provided to the package can be controlled by users without any sanitization, and this is provided to the eval function without any sanitization.
EPSS 2.08% · 81.3th percentile
Risk Scores
CVSS 3.1
8.600000381469727
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
EPSS Score
2.08%
81.3th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ubuntu:18.04:LTS | node-thenify | 0, 3.3.0-1 |
| Ubuntu:20.04:LTS | node-thenify | 0, 3.3.0-1 |
Timeline
- Jul 18, 2022 CVE Published
- Jul 26, 2022 EPSS Score
- Sep 11, 2022 EPSS Score
- Oct 29, 2022 EPSS Score
- Jan 31, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
- Mar 19, 2023 EPSS Score
- May 6, 2023 EPSS Score
- Jun 22, 2023 EPSS Score
- Aug 8, 2023 EPSS Score
- Nov 11, 2023 EPSS Score
- Dec 28, 2023 EPSS Score
References
- https://ubuntu.com/security/CVE-2020-7677 third-party-advisory
- https://security.snyk.io/vuln/SNYK-JS-THENIFY-571690 third-party-advisory
- https://github.com/thenables/thenify/commit/0d94a24eb933bc835d568f3009f4d269c4c4c17a third-party-advisory
- https://github.com/thenables/thenify/blob/master/index.js%23L17 third-party-advisory
- https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-572317 third-party-advisory
- https://ubuntu.com/security/notices/USN-6016-1 vendor-advisory
- https://www.cve.org/CVERecord?id=CVE-2020-7677 third-party-advisory