CVE-2020-6650CWE-95

Arbitrary code execution through “Update Manager” Class

High · published March 23, 2020

CVSS v3.1
8.3
EPSS
2%
Percentile
81.6
In the wild
Unconfirmed
What it is

UPS companion software v1.05 & Prior is affected by ‘Eval Injection’ vulnerability. The software does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call e.g.”eval” in “Update Manager” class when software attempts to see if there are updates available. This results in arbitrary code execution on the machine where software is installed.

The record
Technical detail
CVSS v3.1
8.3 · HIGH
Vector
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.02103 · 81.6th percentile
Weakness
CWE-95 · Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
Published
2020-03-23T13:25Z
EPSS history
Timeline
  • 23 MAR 13:25Z
    Arbitrary code execution through “Update Manager” Class
    cvelistv5