CVE-2020-7769 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	8.6 HIGH	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
snyk	CNA	8.6 HIGH	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H/E:P/RL:U/RC:C

Base Score

CVSS 3.x

EPSS Score

Percentile: 65%

Affected Products (NVD)

Vendor	Product	Version
nodemailer	nodemailer	𝑥 < 6.4.16

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

node-nodemailer

bookworm	6.8.0+~6.4.6-1 fixed
bullseye	6.4.17-3 fixed
sid	6.9.16+~6.4.16-1 fixed
trixie	6.9.15+~6.4.16-1 fixed

Ubuntu Releases

Ubuntu Product

Codename

node-nodemailer

bionic	dne
focal	needed
groovy	ignored
hirsute	not-affected
impish	not-affected
jammy	not-affected
kinetic	not-affected
lunar	not-affected
mantic	not-affected
noble	not-affected
trusty	dne
xenial	dne

Known Exploits!

Common Weakness Enumeration

CWE-88 - Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
The software constructs a string for a command to executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

References

https://github.com/nodemailer/nodemailer/blob/33b62e2ea6bc9215c99a9bb4bfba94e2fb27ebd0/lib/sendmail-transport/index.js%23L75

https://github.com/nodemailer/nodemailer/commit/ba31c64c910d884579875c52d57ac45acc47aa54

https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1039742

https://snyk.io/vuln/SNYK-JS-NODEMAILER-1038834

https://github.com/nodemailer/nodemailer/blob/33b62e2ea6bc9215c99a9bb4bfba94e2fb27ebd0/lib/sendmail-transport/index.js%23L75

https://github.com/nodemailer/nodemailer/commit/ba31c64c910d884579875c52d57ac45acc47aa54

https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1039742

https://snyk.io/vuln/SNYK-JS-NODEMAILER-1038834