by Kastro
Paper/Archive/CVE-2020-7769

CVE-2020-7769

snyk — Command Injection

EPSS 2%CVSS 9.8
critical.is priorityof 100
46
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 83.3.833 × 2016.7No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

This affects the package nodemailer before 6.4.16. Use of crafted recipient email addresses may result in arbitrary command flag injection in sendmail transport for sending mails.

Affected

ProductAffectedFixed inSource
nodemailerunspecified – < 6.4.166.4.16CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
snyk (CNA)8.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H/E:P/RL:U/RC:C

References

refsnyk.io/vuln/SNYK-JS-NODEMAILER-1038834refsnyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1039742refgithub.com/nodemailer/nodemailer/blob/33b62e2ea6bc9215c99a9bb4bfba94e2fb27ebd0/lib/sendmail-transport/index.js%23L75refgithub.com/nodemailer/nodemailer/commit/ba31c64c910d884579875c52d57ac45acc47aa54