CVE-2020-11084CWE-78

Command Injection in iPear

Medium · published July 14, 2020

CVSS v3.1
6.4
EPSS
1%
Percentile
72.8
In the wild
Unconfirmed
What it is

In iPear, the manual execution of the eval() function can lead to command injection. Only PCs where commands are manually executed via "For Developers" are affected. This function allows executing any PHP code within iPear which may change, damage, or steal data (files) from the PC.

The record
Technical detail
CVSS v3.1
6.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.01429 · 72.8th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2020-07-14T21:15Z
EPSS history
Timeline
  • 14 JUL 21:15Z
    Command Injection in iPear
    cvelistv5