CVE-2020-8141

{"containers": {"cna": {"affected": [{"product": "dot", "vendor": "n/a", "versions": [{"status": "affected", "version": "1.1.2"}]}], "descriptions": [{"lang": "en", "value": "The dot package v1.1.2 uses Function() to compile templates. This can be exploited by the attacker if they can control the given template or if they can control the value set on Object.prototype."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-94", "description": "Code Injection (CWE-94)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2020-03-15T17:04:40.000Z", "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "shortName": "hackerone"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://hackerone.com/reports/390929"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "support@hackerone.com", "ID": "CVE-2020-8141", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "dot", "version": {"version_data": [{"version_value": "1.1.2"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The dot package v1.1.2 uses Function() to compile templates. This can be exploited by the attacker if they can control the given template or if they can control the value set on Object.prototype."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Code Injection (CWE-94)"}]}]}, "references": {"reference_data": [{"name": "https://hackerone.com/reports/390929", "refsource": "MISC", "url": "https://hackerone.com/reports/390929"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T09:48:25.637Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://hackerone.com/reports/390929"}]}]}, "cveMetadata": {"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "assignerShortName": "hackerone", "cveId": "CVE-2020-8141", "datePublished": "2020-03-15T17:04:40.000Z", "dateReserved": "2020-01-28T00:00:00.000Z", "dateUpdated": "2024-08-04T09:48:25.637Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "dot", "vendor": "n/a", "versions": [{"status": "affected", "version": "1.1.2"}]}], "source": "support@hackerone.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:dot_project:dot:1.1.2:*:*:*:*:node.js:*:*", "matchCriteriaId": "2A5E89C2-7658-47A1-9D21-6EA241DA6F23", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The dot package v1.1.2 uses Function() to compile templates. This can be exploited by the attacker if they can control the given template or if they can control the value set on Object.prototype."}, {"lang": "es", "value": "El Dot Package versi\u00f3n v1.1.2, utiliza Function() para compilar plantillas. Esto puede ser explotado por el atacante si pueden controlar la plantilla entregada o si pueden controlar el valor establecido en Object.prototype."}], "id": "CVE-2020-8141", "lastModified": "2026-06-17T03:25:55.900", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2020-03-15T18:15:11.287", "references": [{"source": "support@hackerone.com", "tags": ["Exploit", "Mitigation", "Third Party Advisory"], "url": "https://hackerone.com/reports/390929"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Mitigation", "Third Party Advisory"], "url": "https://hackerone.com/reports/390929"}], "sourceIdentifier": "support@hackerone.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "support@hackerone.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-94"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}