PT-2020-19700 · Unknown · Access-Policy

Published 2020-06-10 · Updated 2021-07-21 · CVE-2020-7674

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions access-policy versions prior to 3.1.0

Description The issue allows for Arbitrary Code Execution. This occurs because user input provided to the template function is executed by the eval function, resulting in code execution.

Recommendations For versions prior to 3.1.0, update to version 3.1.0 or later to resolve the issue. As a temporary workaround, consider restricting user input to the template function to minimize the risk of exploitation.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2020-7674

GHSA-FW2F-7F87-5R6C

SNYK-JS-ACCESSPOLICY-571490

Affected Products

Access-Policy

References · 4

• 🔥 https://snyk.io/vuln/SNYK-JS-ACCESSPOLICY-571490 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-7674 · Security Note
• https://osv.dev/vulnerability/CVE-2020-7674 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fw2f-7f87-5r6c · Vendor Advisory