Quick answers
- Is CVE-2020-8137 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2020-8137 being exploited in the wild.
- How severe is CVE-2020-8137?
- Low severity, with a CVSS score of 3.1, published 6 May 2021.
- Which products and versions are affected?
- blamer (npm) 1.0.0 and earlier.
- Is there a fix for CVE-2020-8137?
- A patch was published on 2021-05-06: Fixed in version 1.0.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2020-8137 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2020-8137?
- Check whether you run blamer (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A code injection vulnerability (CWE-94) exists in blamer version 1.0.0 and earlier where unsanitized user input is evaluated or executed as code. The vulnerability is remotely exploitable without requiring authentication or user interaction (CVSS vector AV:N/AC:L/PR:N/UI:N). An attacker can achieve remote code execution by providing malicious input that the library fails to properly sanitize before execution. The vulnerability was fixed in version 1.0.1.
Affected products
- npm blamer 1.0.0 and earlier
Identifiers
- CVE-2020-8137
- GHSA-7vm7-j8p7-h346
Timeline
- 2020-03-20: disclosed
- 2021-05-06: advisory
- 2021-05-06: patched: Fixed in version 1.0.1