Vulnerability · Published Oct 1, 2020 · Assigned by GitHub_M
CVE-2020-15227Remote Code Execution vulnerability
High 8.7
In plain English
A high-severity injection in application from nette. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 34.4% (higher than 98% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)8.7High
Exploit odds (30 days)34.4%top 1.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling2Nuclei, Public PoC
Official description
Nette versions before 2.0.19, 2.1.13, 2.2.10, 2.3.14, 2.4.16, 3.0.6 are vulnerable to an code injection attack by passing specially formed parameters to URL that may possibly leading to RCE. Nette is a PHP/Composer MVC Framework.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | nette/application | 2.2.10 | GHSA-8gv3-3j7f-wg94 |
| Packagist | nette/application | 2.3.14 | GHSA-8gv3-3j7f-wg94 |
| Packagist | nette/application | 2.4.16 | GHSA-8gv3-3j7f-wg94 |
| Packagist | nette/application | 3.0.6 | GHSA-8gv3-3j7f-wg94 |
| Packagist | nette/application | 2.0.19 | GHSA-8gv3-3j7f-wg94 |
| Packagist | nette/application | 2.1.13 | GHSA-8gv3-3j7f-wg94 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| nette | application | >= 2.0.0, < 2.0.19>= 2.1.0, < 2.1.13>= 2.2.0, < 2.2.10>= 2.3.0, < 2.3.14>= 2.4.0, < 2.4.16>= 3.0.0, < 3.0.6 |
Weakness: CWE-74 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
References
- https://github.com/nette/application/security/advisories/GHSA-8gv3-3j7f-wg94 x_refsource_CONFIRM
- https://packagist.org/packages/nette/application x_refsource_MISC
- https://packagist.org/packages/nette/nette x_refsource_MISC
- [debian-lts-announce] 20210404 [SECURITY] [DLA 2617-1] php-nette security update mailing-list, x_refsource_MLIST