CVE-2020-7712 Command Injection
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2020-7712?
CVE-2020-7712 is a high-severity vulnerability in Oracle Commerce Guided Search, published on 30 Aug 2020.
Official description
This affects the package json before 10.0.0. It is possible to inject arbritary commands using the parseLookup function.
Weakness: CWE-78
Which versions are affected by CVE-2020-7712?
4 open source packages ship an affected version, including org.webjars.npm:json and json. It affects 5 products.
| Package | Affected | Fixed in |
|---|---|---|
org.webjars.npm:json Maven | All versions to 9.0.6 | None |
org.webjars.npm:json Maven | All versions to 9.0.6 | None |
json npm | All versions | 10.0.0 |
json npm | All versions | 10.0.0 |
Products include Joyent Json, Oracle Commerce Guided Search, Oracle Financial Services Crime and Compliance Management Studio, Oracle Financial Services Regulatory Reporting With Agilereporter, Oracle Timesten In-Memory Database.
How do I fix CVE-2020-7712?
Upgrade to a fixed version.
Is CVE-2020-7712 being exploited?
There is no known exploitation of CVE-2020-7712 in the wild and no public exploit code.
Sources
Also known as GHSA-3c6g-pvg8-gqw2, MINI-6mqm-xf97-3r7q.