CVE-2017-16020

Summit is a node web framework. When using the PouchDB driver in the module, Summit 0.1.0 and later allows an attacker to execute arbitrary commands via the collection name.
Code Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
hackeroneCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 73%
VendorProductVersion
summit_projectsummit
0.1.0 ≤
𝑥
≤ 0.1.21
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/notduncansmith/summit/issues/23
https://nodesecurity.io/advisories/315
https://github.com/notduncansmith/summit/issues/23
https://nodesecurity.io/advisories/315