GitHub Advisoryadvisory · Packagist

GHSA-8gv3-3j7f-wg94 Potential Remote Code Execution vulnerability

HIGH Published 2020-10-02 Modified 2021-11-19 Official page ↗
Aliases
CVE-2020-15227
Ecosystem
Packagist
Packages
nette/application
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
Weaknesses
CWE-74, CWE-94
Reviewed
2020-10-01

Affected packages

• Packagist nette/application: >= 2.2.0, < 2.2.10 → fixed in 2.2.10 • Packagist nette/application: >= 2.3.0, < 2.3.14 → fixed in 2.3.14 • Packagist nette/application: >= 2.4.0, < 2.4.16 → fixed in 2.4.16 • Packagist nette/application: >= 3.0.0, < 3.0.6 → fixed in 3.0.6 • Packagist nette/application: >= 2.0.0, < 2.0.19 → fixed in 2.0.19 • Packagist nette/application: >= 2.1.0, < 2.1.13 → fixed in 2.1.13

Description

Packages nette/application versions prior to 2.2.10, 2.3.14, 2.4.16, 3.0.6 and nette/nette versions prior to 2.0.19 and 2.1.13 are vulnerable to an code injection attack by passing specially formed parameters to URL that may possibly leading to RCE. Reported by Cyku Hong from DEVCORE (https://devco.re) Impact Code injection, possible remote code execution. Patches Fixed in nette/application 2.2.10, 2.3.14, 2.4.16, 3.0.6 and nette/nette 2.0.19 and 2.1.13

Related

Alias · CVE (1)

  • CVE-2020-15227 Nette versions before 2.0.19, 2.1.13, 2.2.10, 2.3.14, 2.4.16, 3.0.6 are vulnerable to an code injection attack by passing specially formed… vulnerability

Weakness · CWE (2)

  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness
  • CWE-94 Improper Control of Generation of Code weakness

References