CVE Vulnerability

CVE-2020-28494

This affects the package total.js before 3.4.7. The issue occurs in the image.pipe and image.stream functions. The type parameter is used to build the command that is then executed using child_process.spawn. The issue occurs because child_process.spawn is called with the option shell set to true and because the type parameter is not properly sanitized.

7.5 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 10 / Impact : 6.4

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

Scope

8.6 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 4.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://snyk.io/vuln/SNYK-JS-TOTALJS-1046672 Exploit Patch
https://github.com/totaljs/framework/commit/6192491ab2631e7c1d317c221f18ea613e2c18a5 Patch Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:totaljs:total.js:*:*:*:*:*:node.js:*:*
Information

Published : 2021-02-02 11:15

Updated : 2021-07-21 11:39

NVD link : CVE-2020-28494

Mitre link : CVE-2020-28494

Products Affected
No products.
CWE
CWE-78