CVE-2020-7778: Prototype Pollution
First published: Thu Nov 26 2020(Updated: )
This affects the package systeminformation before 4.30.2. The attacker can overwrite the properties and functions of an object, which can lead to executing OS commands.
Credit: report@snyk.io
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Systeminformation Systeminformation Node.js | <4.30.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://gist.github.com/EffectRenan/b434438938eed0b21b376cedf5c81e80
- https://github.com/sebhildebrandt/systeminformation/blob/master/lib/internet.js
- https://github.com/sebhildebrandt/systeminformation/commit/11103a447ab9550c25f1fbec7e6d903720b3fea8%23diff-970ae648187190f86bafc8f193b7538200eba164fad0674428b6487582c089cc
- https://github.com/sebhildebrandt/systeminformation/commit/73dce8d717ca9c3b7b0d0688254b8213b957f0fa%23diff-970ae648187190f86bafc8f193b7538200eba164fad0674428b6487582c089cc
- https://snyk.io/vuln/SNYK-JS-SYSTEMINFORMATION-1043753
Frequently Asked Questions
What is CVE-2020-7778?
CVE-2020-7778 is a vulnerability in the systeminformation package before version 4.30.2 that allows an attacker to overwrite object properties and functions, potentially leading to the execution of OS commands.
What software is affected by CVE-2020-7778?
The systeminformation package before version 4.30.2 is affected by CVE-2020-7778.
How severe is CVE-2020-7778?
CVE-2020-7778 has a severity score of 7.3 (high).
How can CVE-2020-7778 be exploited?
CVE-2020-7778 can be exploited by an attacker overwriting the properties and functions of an object.
How can I fix CVE-2020-7778?
To fix CVE-2020-7778, update the systeminformation package to version 4.30.2 or later.
- agent/type
- agent/remedy
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/references
- agent/author
- agent/weakness
- agent/description
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/severity
- agent/title
- agent/tags
- agent/first-publish-date
- agent/event
- vendor/systeminformation
- canonical/systeminformation systeminformation node.js