Quick answers
- Is CVE-2020-7624 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2020-7624 being exploited in the wild.
- How severe is CVE-2020-7624?
- Critical severity, with a CVSS score of 9.8, published 10 February 2022.
- Which products and versions are affected?
- effect (npm) <= 1.0.4, SEMVER:introduced=0,last_affected=1.0.4.
- Is there a fix for CVE-2020-7624?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2020-7624 attacked?
- It is attacked over the network.
- Am I affected by CVE-2020-7624?
- Check whether you run effect (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The original advisory alleged that the "effect" npm package through version 1.0.4 was vulnerable to OS command injection (CWE-78) via unsanitized user input in the options parameter. However, the advisory was withdrawn on June 4, 2024, for two critical reasons: (1) the npm package "effect" does not correspond to the vulnerable GitHub repository (https://github.com/Javascipt/effect), which is not in a supported ecosystem, and (2) the CVE Numbering Authority that issued CVE-2020-7624 has updated their advisory stating that "This was deemed not a vulnerability." As such, this is not an actionable security issue.
Affected products
- npm effect <= 1.0.4
Identifiers
- CVE-2020-7624
- GHSA-6hr9-4692-fch9
Timeline
- 2020-04-02: disclosed
- 2022-02-10: advisory: Added to GitHub Advisory Database
- 2024-06-04: other: Advisory withdrawn; CVE issuer deemed not a vulnerability