In short
- CVE-2020-7606 is a CRITICAL (CVSS 9.8) vulnerability affecting docker-compose-remote-api (docker-compose-remote-api project), docker-compose-remote-api.
- Chance of exploitation in the next 30 days (EPSS): 2.7%, higher than 86.1% of all vulnerabilities.
- No patched version is listed yet: follow the vendor's advisory in References.
Description
docker-compose-remote-api through 0.1.4 allows execution of arbitrary commands. Within index.js of the package, the function exec(serviceName, cmd, fnStdout, fnStderr, fnExit) uses the variable serviceName which can be controlled by users without any sanitization.
NVD description
docker-compose-remote-api through 0.1.4 allows execution of arbitrary commands. Within 'index.js' of the package, the function 'exec(serviceName, cmd, fnStdout, fnStderr, fnExit)' uses the variable 'serviceName' which can be controlled by users without any sanitization.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free