PT-2021-11535 · Djv · Djv

Alessio Della Libera + 1 · Published 2021-01-04 · Updated 2021-07-21 · CVE-2020-28464

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: djv versions prior to 2.1.4

Description: The issue allows an attacker to run arbitrary JavaScript code on the victim machine by controlling the schema file.

Recommendations: For versions prior to 2.1.4, update to version 2.1.4 or later to resolve the issue.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2020-28464

GHSA-4HV7-3Q38-97M8

SNYK-JS-DJV-1014545

Affected Products

Djv

References · 7

• 🔥 https://snyk.io/vuln/SNYK-JS-DJV-1014545 · Exploit
• https://github.com/korzio/djv/pull/98/files · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-28464 · Security Note
• https://osv.dev/vulnerability/CVE-2020-28464 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4hv7-3q38-97m8 · Vendor Advisory
• https://github.com/korzio/djv/blob/master/lib/utils/properties.js%23L55 · Note
• https://t.me/cvenotify/8142 · Telegram Post