DLL Injection in kerberos

ÉLEVÉE 7.8CVE-2020-13110 · GHSA-m2mx-rfpw-jghv · Published 16/05/2020 · updated 17/06/2026

En bref

CVE-2020-13110 est une vulnérabilité ÉLEVÉE (CVSS 7.8) touchant kerberos (kerberos project), kerberos.
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.74%, plus élevée que 54.8% des vulnérabilités.
Correctif : mettre à jour vers 1.0.0 ou plus récent.

Package	Affected versions	Patched versions
kerberos kerberos_project	`< 1.0.0`	`1.0.0`
kerberos npm	`< 1.0.0`	`1.0.0`

Description

Version of kerberos prior to 1.0.0 are vulnerable to DLL Injection. The package loads DLLs without specifying a full path. This may allow attackers to create a file with the same name in a folder that precedes the intended file in the DLL path search. Doing so would allow attackers to execute arbitrary code in the machine.

Recommendation

Upgrade to version 1.0.0 or later.

NVD description

The kerberos package before 1.0.0 for Node.js allows arbitrary code execution and privilege escalation via injection of malicious DLLs through use of the kerberos_sspi LoadLibrary() method, because of a DLL path search.

References

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free