CVE-2020-7730: Command Injection
Published Sep 4, 2020
·Updated
The package bestzip before 2.1.7 are vulnerable to Command Injection via the options param.
Affected Software
1 affected component
Bestzip Project Bestzip Node.js<2.1.7
Remediation
Patch Available
Event History
Sep 4, 2020
CVE Published
via MITRE·09:30 AM
Data Sourced
via MITRE·09:30 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which versions need to be remediated?
bestzip versions before 2.1.7 are affected. Update to version 2.1.7 or later, as a patch is available.
2
What access does an attacker need to exploit this issue?
The CVSS vector indicates network exploitation is possible with low attack complexity, no privileges, and no user interaction. Successful exploitation can compromise confidentiality, integrity, and availability.
3
What application behavior creates exposure?
Exposure exists when the application passes attacker-controlled input through bestzip's options parameter. That parameter is the identified command-injection vector.