CVE-2020-6948 - A remote code execution issue was discovered in HashBrown CMS through 1.3.3

Back Back to CVE browser

CRITICAL

A remote code execution issue was discovered in HashBrown CMS through 1.3.3

Published Jan 13, 2020

9.8

CRITICAL

CVSS 3.1

EPSS 2.80%

Description

A remote code execution issue was discovered in HashBrown CMS through 1.3.3. Server/Entity/Deployer/GitDeployer.js has a Service.AppService.exec call that mishandles the URL, repository, username, and password.

Affected products

Ecosystem	Package	Introduced	Fixed
npm	hashbrown-cms	0	1.3.4

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-20

Improper Input Validation

CWE-78

OS Command Injection

References (4)

https://github.com/HashBrownCMS/hashbrown-cms/commit/ff95bbad391fb7111355c643cadc02fe8792d758
https://github.com/HashBrownCMS/hashbrown-cms/issues/326
x_refsource_MISCExploitThird Party Advisory
https://github.com/advisories/GHSA-4gjv-5jjp-rcgh
Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-6948

Link	Providers	Tags
https://github.com/HashBrownCMS/hashbrown-cms/commit/ff95bbad391fb7111355c643cadc02fe8792d758
https://github.com/HashBrownCMS/hashbrown-cms/issues/326		x_refsource_MISCExploitThird Party Advisory
https://github.com/advisories/GHSA-4gjv-5jjp-rcgh		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-6948