CVE-2020-15227CWE-74

Remote Code Execution vulnerability

High · published October 1, 2020

CVSS v3.1

8.7

EPSS

34%

Percentile

98.4

In the wild

Unconfirmed

What it is

Nette versions before 2.0.19, 2.1.13, 2.2.10, 2.3.14, 2.4.16, 3.0.6 are vulnerable to an code injection attack by passing specially formed parameters to URL that may possibly leading to RCE. Nette is a PHP/Composer MVC Framework.

The record

Technical detail

CVSS v3.1: 8.7 · HIGH
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
CVSS v4.0: Not supplied
EPSS: 0.34424 · 98.4th percentile
Weakness: CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Published: 2020-10-01T19:00Z

EPSS history

Timeline

01 OCT 19:00Z
Remote Code Execution vulnerability
cvelistv5