Paper/Archive/CVE-2020-7624

CVE-2020-7624

snyk — effect through 1.0.4 is vulnerable to Command Injection.

EPSS 4%CVSS 9.8

critical.is priorityof 100

48

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 91.0.910 × 2018.2 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

effect through 1.0.4 is vulnerable to Command Injection. It allows execution of arbitrary command via the options argument.

Affected

ProductAffectedFixed inSource

effectAll versions including 1.0.4–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refgithub.com/Javascipt/effect/blob/master/helper.js#L24%2C refsnyk.io/vuln/SNYK-JS-EFFECT-564256