En resumen
- CVE-2020-11079 es una vulnerabilidad CRÍTICO (CVSS 9.8) que afecta a node-dns-sync (node-dns-sync project), dns-sync.
- Probabilidad de explotación en los próximos 30 días (EPSS): 2.7%, mayor que el 85.9% de las vulnerabilidades.
- Solución: actualizar a 0.2.1 o posterior.
Description
dns-sync through 0.2.0 allows execution of arbitrary commands . This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input.
NVD description
node-dns-sync (npm module dns-sync) through 0.2.0 allows execution of arbitrary commands . This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input. This has been fixed in 0.2.1.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free