high8.7
CVE-2020-15227
Nette versions before 2.0.19, 2.1.13, 2.2.10, 2.3.14, 2.4.16, 3.0.6 are vulnerable to an code injection attack by passing specially formed parameters to URL th…
Impact
Nette versions before 2.0.19, 2.1.13, 2.2.10, 2.3.14, 2.4.16, 3.0.6 are vulnerable to an code injection attack by passing specially formed parameters to URL that may possibly leading to RCE. Nette is a PHP/Composer MVC Framework.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Nette | Application | from 2.0.0 before 2.0.19 from 2.1.0 before 2.1.13 from 2.2.0 before 2.2.10 from 2.3.0 before 2.3.14 from 2.4.0 before 2.4.16 from 3.0.0 before 3.0.6 |
| Debian | Debian Linux | Version 9.0 |
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/nette/application/security/advisories/GHSA-8gv3-3j7f-wg94
- https://lists.debian.org/debian-lts-announce/2021/04/msg00003.html
- https://packagist.org/packages/nette/application
- https://packagist.org/packages/nette/nette
- https://github.com/nette/application/security/advisories/GHSA-8gv3-3j7f-wg94
- https://lists.debian.org/debian-lts-announce/2021/04/msg00003.html
- https://packagist.org/packages/nette/application
- https://packagist.org/packages/nette/nette