// For flags

CVE-2020-7712

Command Injection

Severity Score

7.2
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

3
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

This affects the package json before 10.0.0. It is possible to inject arbritary commands using the parseLookup function.

Esto afecta al paquete json versiones anteriores a 10.0.0. Es posible inyectar comandos arbitrarios usando la función parseLookup

*Credits: po6ix
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
Single
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2020-01-21 CVE Reserved
  • 2020-08-30 CVE Published
  • 2024-07-21 EPSS Updated
  • 2024-09-17 CVE Updated
  • 2024-09-17 First Exploit
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CAPEC
References (22)
URL Tag Source
https://lists.apache.org/thread.html/r37c0e1807da7ff2bdd028bbe296465a6bbb99e2320dbe661d5d8b33b%40%3Cissues.zookeeper.apache.org%3E Mailing List
https://lists.apache.org/thread.html/r3b04f4e99a19613f88ae088aa18cd271231a3c79dfff8f5efa8cda61%40%3Cissues.zookeeper.apache.org%3E Mailing List
https://lists.apache.org/thread.html/r5f17bfca1d6e7f4b33ae978725b2fd62a9f1b3111696eafa9add802d%40%3Cissues.zookeeper.apache.org%3E Mailing List
https://lists.apache.org/thread.html/r8d2e174230f6d26e16c007546e804c343f1f68956f526daaafa4aaae%40%3Cdev.zookeeper.apache.org%3E Mailing List
https://lists.apache.org/thread.html/r977a907ecbedf87ae5ba47d4c77639efb120f74d4d1b3de14a4ef4da%40%3Cissues.flink.apache.org%3E Mailing List
https://lists.apache.org/thread.html/r9c6d28e5b9a9b3481b7d1f90f1c2f75cd1a5ade91038426e0fb095da%40%3Cdev.flink.apache.org%3E Mailing List
https://lists.apache.org/thread.html/ra890c24b3d90be36daf48ae76b263acb297003db24c1122f8e4aaef2%40%3Cissues.flink.apache.org%3E Mailing List
https://lists.apache.org/thread.html/rb023d54a46da1ac0d8969097f5fecc79636b07d3b80db7b818a5c55c%40%3Cissues.zookeeper.apache.org%3E Mailing List
https://lists.apache.org/thread.html/rb2b981912446a74e14fe6076c4b7c7d8502727ea0718e6a65a9b1be5%40%3Cissues.zookeeper.apache.org%3E Mailing List
https://lists.apache.org/thread.html/rb89bd82dffec49f83b49e9ad625b1b63a408b3c7d1a60d6f049142a0%40%3Cissues.flink.apache.org%3E Mailing List
https://lists.apache.org/thread.html/rba7ea4d75d6a8e5b935991d960d9b893fd30e576c4d3b531084ebd7d%40%3Cissues.flink.apache.org%3E Mailing List
https://lists.apache.org/thread.html/rd9b9cc843f5cf5b532bdad9e87a817967efcf52b917e8c43b6df4cc7%40%3Cissues.zookeeper.apache.org%3E Mailing List
https://lists.apache.org/thread.html/rec8bb4d637b04575da41cfae49118e108e95d43bfac39b7b698ee4db%40%3Cissues.zookeeper.apache.org%3E Mailing List
https://lists.apache.org/thread.html/ree3abcd33c06ee95ab59faa1751198a1186d8941ddc2c2562c12966c%40%3Cissues.zookeeper.apache.org%3E Mailing List
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-608932 Broken Link
URL Date SRC
https://github.com/trentm/json/issues/144 2024-09-17
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-608931 2024-09-17
https://snyk.io/vuln/SNYK-JS-JSON-597481 2024-09-17
URL Date SRC
https://github.com/trentm/json/pull/145 2023-11-07
https://www.oracle.com//security-alerts/cpujul2021.html 2023-11-07
https://www.oracle.com/security-alerts/cpujan2022.html 2023-11-07
https://www.oracle.com/security-alerts/cpujul2022.html 2023-11-07
URL Date SRC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Joyent
Search vendor "Joyent"
 Json
Search vendor "Joyent" for product "Json"
 < 10.0.0
Search vendor "Joyent" for product "Json" and version " < 10.0.0"
node.js
Affected
Oracle
Search vendor "Oracle"
 Commerce Guided Search
Search vendor "Oracle" for product "Commerce Guided Search"
 11.3.2
Search vendor "Oracle" for product "Commerce Guided Search" and version "11.3.2"
-
Affected
Oracle
Search vendor "Oracle"
 Financial Services Crime And Compliance Management Studio
Search vendor "Oracle" for product "Financial Services Crime And Compliance Management Studio"
 8.0.8.2.0
Search vendor "Oracle" for product "Financial Services Crime And Compliance Management Studio" and version "8.0.8.2.0"
-
Affected
Oracle
Search vendor "Oracle"
 Financial Services Crime And Compliance Management Studio
Search vendor "Oracle" for product "Financial Services Crime And Compliance Management Studio"
 8.0.8.3.0
Search vendor "Oracle" for product "Financial Services Crime And Compliance Management Studio" and version "8.0.8.3.0"
-
Affected
Oracle
Search vendor "Oracle"
 Financial Services Regulatory Reporting With Agilereporter
Search vendor "Oracle" for product "Financial Services Regulatory Reporting With Agilereporter"
 8.0.9.6.3
Search vendor "Oracle" for product "Financial Services Regulatory Reporting With Agilereporter" and version "8.0.9.6.3"
-
Affected
Oracle
Search vendor "Oracle"
 Timesten In-memory Database
Search vendor "Oracle" for product "Timesten In-memory Database"
 < 21.1.1.1.0
Search vendor "Oracle" for product "Timesten In-memory Database" and version " < 21.1.1.1.0"
-
Affected