CVE-2020-15227
8.7
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
Summary
Nette versions before 2.0.19, 2.1.13, 2.2.10, 2.3.14, 2.4.16, 3.0.6 are vulnerable to an code injection attack by passing specially formed parameters to URL that may possibly leading to RCE. Nette is a PHP/Composer MVC Framework.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| nette | application | >= 2.0.0, < 2.0.19 | affected |
| nette | application | >= 2.1.0, < 2.1.13 | affected |
| nette | application | >= 2.2.0, < 2.2.10 | affected |
| nette | application | >= 2.3.0, < 2.3.14 | affected |
| nette | application | >= 2.4.0, < 2.4.16 | affected |
| nette | application | >= 3.0.0, < 3.0.6 | affected |
Weaknesses
- CWE-74: CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
ADP Enrichment
CVE Program Container
Additional References
- https://github.com/nette/application/security/advisories/GHSA-8gv3-3j7f-wg94
- https://packagist.org/packages/nette/application
- https://packagist.org/packages/nette/nette
- https://lists.debian.org/debian-lts-announce/2021/04/msg00003.html
References
- https://github.com/nette/application/security/advisories/GHSA-8gv3-3j7f-wg94
- https://packagist.org/packages/nette/application
- https://packagist.org/packages/nette/nette
- https://lists.debian.org/debian-lts-announce/2021/04/msg00003.html
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.