CVE Vulnerability

CVE-2020-15150

There is a vulnerability in Paginator (Elixir/Hex package) which makes it susceptible to Remote Code Execution (RCE) attacks via input parameters to the paginate() function. This will potentially affect all current users of Paginator prior to version 1.0.0. The vulnerability has been patched in version 1.0.0 and all users should upgrade to this version immediately. Note that this patched version uses a dependency that requires an Elixir version >=1.5.

7.5 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 10 / Impact : 6.4

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

Scope

9.8 /10

CVSS v3.0 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/duffelhq/paginator/commit/bf45e92602e517c75aea0465efc35cd661d9ebf8 Patch Third Party Advisory
https://github.com/duffelhq/paginator/security/advisories/GHSA-w98m-2xqg-9cvj Third Party Advisory
https://github.com/duffelhq/paginator/blob/ccf0f37fa96347cc8c8a7e9eb2c64462cec4b2dc/README.md#security-considerations Third Party Advisory
https://hex.pm/packages/paginator Product
Configurations

Configuration 1

cpe:2.3:a:duffel:paginator:*:*:*:*:*:elixir:*:*
Information

Published : 2020-09-01 05:15

Updated : 2020-09-11 02:34

NVD link : CVE-2020-15150

Mitre link : CVE-2020-15150

Products Affected
No products.
CWE
CWE-94