Vulnerability · Published Jul 14, 2020 · Assigned by GitHub_M
CVE-2020-11084Command Injection in iPear
Medium 6.4
In plain English
A medium-severity OS command injection in iPear from yaBobJonez. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 73% of all known vulnerabilities).
Severity (CVSS 3.1)6.4Medium
Exploit odds (30 days)1.4%top 26.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
In iPear, the manual execution of the eval() function can lead to command injection. Only PCs where commands are manually executed via "For Developers" are affected. This function allows executing any PHP code within iPear which may change, damage, or steal data (files) from the PC.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| yaBobJonez | iPear | >= 0.6.14, <= 0.6.15= 0.7.0 |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
References
- https://github.com/yaBobJonez/iPear/security/advisories/GHSA-4xvp-35fx-hjjj x_refsource_CONFIRM