En bref
- CVE-2017-16020 est une vulnérabilité CRITIQUE (CVSS 9.8) touchant summit (summit project), summit.
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 2.5%, plus élevée que 84.5% des vulnérabilités.
- Aucune version corrigée n'est encore connue : suivez l'avis de l'éditeur dans les références.
| Package | Affected versions | Patched versions |
|---|
| summit | ≥ 0.1.0, ≤ 0.1.21
| No fix yet |
| summit npm | ≥ 0.1.0, ≤ 0.1.22
| No fix yet |
Description
Affected versions of summit allow attackers to execute arbitrary commands via collection names when using the PouchDB driver.
Recommendation
No direct patch is available at this time.
Currently, the best option to mitigate the issue is to avoid using the PouchDB driver, as the package author has abandoned this feature entirely.
NVD description
Summit is a node web framework. When using the PouchDB driver in the module, Summit 0.1.0 and later allows an attacker to execute arbitrary commands via the collection name.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free