CVE-2017-16020

EUVD-2020-0999
Summit is a node web framework. When using the PouchDB driver in the module, Summit 0.1.0 and later allows an attacker to execute arbitrary commands via the collection name.
Code Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 73%
Affected Products (NVD)
VendorProductVersion
summit_projectsummit
0.1.0 ≤
𝑥
≤ 0.1.21
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/notduncansmith/summit/issues/23
https://nodesecurity.io/advisories/315
https://github.com/notduncansmith/summit/issues/23
https://nodesecurity.io/advisories/315