Vulnerability · Published Jul 25, 2022 · Assigned by snyk
CVE-2020-7677Arbitrary Code Execution
High 8.6
In plain English
A high-severity security flaw in thenify. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.1% (higher than 82% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)8.6High
Exploit odds (30 days)2.1%top 18.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
This affects the package thenify before 3.3.1. The name argument provided to the package can be controlled by users without any sanitization, and this is provided to the eval function without any sanitization.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | node-thenify | 3.3.1-1 | DEBIAN-CVE-2020-7677 |
| Debian:13 | node-thenify | 3.3.1-1 | DEBIAN-CVE-2020-7677 |
| Debian:14 | node-thenify | 3.3.1-1 | DEBIAN-CVE-2020-7677 |
| Maven | org.webjars.npm:thenify | 3.3.1 | GHSA-29xr-v42j-r956 |
| npm | thenify | 3.3.1 | GHSA-29xr-v42j-r956 |
Affected products (as reported)
References
- https://security.snyk.io/vuln/SNYK-JS-THENIFY-571690
- https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-572317
- https://github.com/thenables/thenify/blob/master/index.js%23L17
- https://github.com/thenables/thenify/commit/0d94a24eb933bc835d568f3009f4d269c4c4c17a
- [debian-lts-announce] 20220930 [SECURITY] [DLA 3128-1] node-thenify security update mailing-list
- FEDORA-2023-ce8943223c vendor-advisory
- FEDORA-2023-18fd476362 vendor-advisory