PT-2020-19658 · Pomelo · Pomelo-Monitor

Published 2020-04-02 · Updated 2021-07-21 · CVE-2020-7620

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions pomelo-monitor versions prior to 0.3.8

Description The issue allows for Command Injection, enabling the injection of arbitrary commands as part of pomelo-monitor params.

Recommendations For versions prior to 0.3.8, update to version 0.3.8 or later to resolve the issue. As a temporary workaround, consider restricting access to the pomelo-monitor params to minimize the risk of exploitation.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2020-7620

GHSA-4J54-MXF6-WXX2

SNYK-JS-POMELOMONITOR-173695

Affected Products

Pomelo-Monitor

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2020-7620 · Security Note
• https://osv.dev/vulnerability/CVE-2020-7620 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4j54-mxf6-wxx2 · Vendor Advisory
• https://github.com/halfblood369/monitor/blob/900b5cadf59edcccac4754e5706a22719925ddb9/lib/processMonitor.js, · Note
• https://github.com/halfblood369/monitor/blob/900b5cadf59edcccac4754e5706a22719925ddb9/lib/processMonitor.js%2C · Note
• https://snyk.io/vuln/SNYK-JS-POMELOMONITOR-173695 · Note