CVEvulnerability
CVE-2020-7752
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2020-10-26
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 6.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:P
- Weaknesses
- CWE-78
Description
This affects the package systeminformation before 4.27.11. This package is vulnerable to Command Injection. The attacker can concatenate curl's parameters to overwrite Javascript files and then execute any OS commands.
Affected configurations
• systeminformation systeminformation (< 4.27.11)
Related
Weakness · CWE (1)
- CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness
References
- https://github.com/sebhildebrandt/systeminformation/blob/master/lib/internet.js Exploit, Third Party Advisory
- https://github.com/sebhildebrandt/systeminformation/commit/931fecaec2c1a7dcc10457bb8cd552d08089da61 Patch, Third Party Advisory
- https://snyk.io/vuln/SNYK-JS-SYSTEMINFORMATION-1021909 Exploit, Patch, Third Party Advisory
- https://github.com/sebhildebrandt/systeminformation/blob/master/lib/internet.js Exploit, Third Party Advisory
- https://github.com/sebhildebrandt/systeminformation/commit/931fecaec2c1a7dcc10457bb8cd552d08089da61 Patch, Third Party Advisory
- https://snyk.io/vuln/SNYK-JS-SYSTEMINFORMATION-1021909 Exploit, Patch, Third Party Advisory