PT-2020-14228 · Elixir · Paginator

Peter Stöckli · Published 2020-09-01 · Updated 2022-04-12 · CVE-2020-15150

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Paginator versions prior to 1.0.0

Description The issue allows for Remote Code Execution (RCE) attacks via input parameters to the paginate() function. This potentially affects all current users of Paginator prior to version 1.0.0.

Recommendations For versions prior to 1.0.0, upgrade to version 1.0.0 immediately, ensuring your Elixir version is >=1.5 to accommodate the dependency requirements of the patched version. As a temporary workaround, consider restricting input parameters to the paginate() function until the upgrade is possible.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2020-15150

GHSA-W98M-2XQG-9CVJ

Affected Products

Paginator

References · 8

• https://github.com/duffelhq/paginator/commit/bf45e92602e517c75aea0465efc35cd661d9ebf8 · Patch
• https://osv.dev/vulnerability/GHSA-w98m-2xqg-9cvj · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15150 · Security Note
• https://osv.dev/vulnerability/CVE-2020-15150 · Vendor Advisory
• https://github.com/duffelhq/paginator/security/advisories/GHSA-w98m-2xqg-9cvj · Note
• https://github.com/duffelhq/paginator/blob/ccf0f37fa96347cc8c8a7e9eb2c64462cec4b2dc/README.md#security-considerations · Note
• https://github.com/duffelhq/paginator · Note
• https://hex.pm/packages/paginator · Note