GitHub Advisoryadvisory · npm

GHSA-m2mx-rfpw-jghv DLL Injection in kerberos

HIGH Published 2020-09-04 Modified 2023-08-21 Official page ↗
Aliases
CVE-2020-13110
Ecosystem
npm
Packages
kerberos
Severity
High
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-427
Reviewed
2020-08-31

Affected packages

• npm kerberos: < 1.0.0 → fixed in 1.0.0

Description

Version of `kerberos` prior to 1.0.0 are vulnerable to DLL Injection. The package loads DLLs without specifying a full path. This may allow attackers to create a file with the same name in a folder that precedes the intended file in the DLL path search. Doing so would allow attackers to execute arbitrary code in the machine. Recommendation Upgrade to version 1.0.0 or later.

Related

Alias · CVE (1)

  • CVE-2020-13110 The kerberos package before 1.0.0 for Node.js allows arbitrary code execution and privilege escalation via injection of malicious DLLs… vulnerability

Weakness · CWE (1)

  • CWE-427 Uncontrolled Search Path Element weakness

References