high7.8
CVE-2020-13110
The kerberos package before 1.0.0 for Node.js allows arbitrary code execution and privilege escalation via injection of malicious DLLs through use of the kerbe…
Impact
The kerberos package before 1.0.0 for Node.js allows arbitrary code execution and privilege escalation via injection of malicious DLLs through use of the kerberos_sspi LoadLibrary() method, because of a DLL path search.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Kerberos Project | Kerberos | before 1.0.0 |
Weakness classification
References
- NVD record
- CVE.org record
- https://medium.com/%40kiddo_Ha3ker/dll-injection-attack-in-kerberos-npm-package-cb4b32031cd
- https://www.linkedin.com/posts/op-innovate_dll-injection-attack-in-kerberos-npm-package-activity-6667043749547253760-kVlW
- https://www.npmjs.com/advisories/1514
- https://www.op-c.net/2020/05/15/dll-injection-attack-in-kerberos-npm-package/
- https://medium.com/%40kiddo_Ha3ker/dll-injection-attack-in-kerberos-npm-package-cb4b32031cd
- https://www.linkedin.com/posts/op-innovate_dll-injection-attack-in-kerberos-npm-package-activity-6667043749547253760-kVlW
- https://www.npmjs.com/advisories/1514
- https://www.op-c.net/2020/05/15/dll-injection-attack-in-kerberos-npm-package/