Lucene search

GitHub_MCVE-2020-11084

HistoryJul 14, 2020 - 10:15 p.m.

CVE-2020-11084

2020-07-1422:15:10

CWE-78

CWE-77

GitHub_M

web.nvd.nist.gov

ipear

eval()

command injection

cve-2020-11084

nvd

CVSS2

5.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:P/A:N

CVSS3

6.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

AI Score

6.1

Confidence

High

EPSS

0.001

Percentile

21.9%

JSON

In iPear, the manual execution of the eval() function can lead to command injection. Only PCs where commands are manually executed via “For Developers” are affected. This function allows executing any PHP code within iPear which may change, damage, or steal data (files) from the PC.

Affected configurations

Nvd

Vulners

Node

ipear_projectipearMatch0.6.14

ipear_projectipearMatch0.6.15

ipear_projectipearMatch0.7.0

VendorProductVersionCPE
ipear_projectipear0.6.14cpe:2.3:a:ipear_project:ipear:0.6.14:*:*:*:*:*:*:*
ipear_projectipear0.6.15cpe:2.3:a:ipear_project:ipear:0.6.15:*:*:*:*:*:*:*
ipear_projectipear0.7.0cpe:2.3:a:ipear_project:ipear:0.7.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ipear_project	ipear	0.6.14	cpe:2.3:a:ipear_project:ipear:0.6.14:::::::*
ipear_project	ipear	0.6.15	cpe:2.3:a:ipear_project:ipear:0.6.15:::::::*
ipear_project	ipear	0.7.0	cpe:2.3:a:ipear_project:ipear:0.7.0:::::::*

CNA Affected

[
  {
    "product": "iPear",
    "vendor": "yaBobJonez",
    "versions": [
      {
        "status": "affected",
        "version": ">= 0.6.14, <= 0.6.15"
      },
      {
        "status": "affected",
        "version": "= 0.7.0"
      }
    ]
  }
]

References

github.com/yaBobJonez/iPear/security/advisories/GHSA-4xvp-35fx-hjjj

CVSS2

5.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:P/A:N

CVSS3

6.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

AI Score

6.1

Confidence

High

EPSS

0.001

Percentile

21.9%

JSON

Related for CVE-2020-11084