PT-2020-16373 · Systeminformation · Systeminformation

Sebhildebrandt · Published 2020-11-27 · Updated 2020-12-03 · CVE-2020-26245

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions systeminformation versions prior to 4.30.5

Description The issue is a command injection vulnerability caused by prototype pollution. It was fixed with a rewrite of shell sanitations to avoid prototype pollution problems.

Recommendations For versions prior to 4.30.5, upgrade to version 4.30.5 or later. If you cannot upgrade, be sure to check or sanitize service parameter strings that are passed to si.inetChecksite().

Fix

OS Command Injection

Weakness Enumeration

CWE-471

CWE-78

Related Identifiers

CVE-2020-26245

GHSA-4V2W-H9JM-MQJG

Affected Products

Systeminformation

References · 7

• https://github.com/sebhildebrandt/systeminformation/commit/8113ff0e87b2f422a5756c48f1057575e73af016 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-26245 · Security Note
• https://osv.dev/vulnerability/GHSA-4v2w-h9jm-mqjg · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-26245 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-26245 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-26245 · Vendor Advisory
• https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-4v2w-h9jm-mqjg · Note