« Volver al listado

CVE-2020-11084

Estado: ModificadaMedia (5.4)—

In iPear, the manual execution of the eval() function can lead to command injection. Only PCs where commands are manually executed via "For Developers" are affected. This function allows executing any PHP code within iPear which may change, damage, or steal data (files) from the PC.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Ipear Project — Ipear

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-11084",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 4.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 3.1
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "yaBobJonez",
          "product": "iPear",
          "versions": [
            {
              "status": "affected",
              "version": ">= 0.6.14, <= 0.6.15"
            },
            {
              "status": "affected",
              "version": "= 0.7.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-07-14T22:15:10.623",
  "references": [
    {
      "url": "https://github.com/yaBobJonez/iPear/security/advisories/GHSA-4xvp-35fx-hjjj",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/yaBobJonez/iPear/security/advisories/GHSA-4xvp-35fx-hjjj",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-77"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In iPear, the manual execution of the eval() function can lead to command injection. Only PCs where commands are manually executed via \"For Developers\" are affected. This function allows executing any PHP code within iPear which may change, damage, or steal data (files) from the PC."
    },
    {
      "lang": "es",
      "value": "En iPear, la ejecución manual de la función eval() puede conducir a la inyección de comandos. Solo están afectadas las PC donde los comandos se ejecutan manualmente por medio de \"For Developers\". Esta función permite ejecutar cualquier código PHP dentro de iPear que pueda cambiar, dañar o robar datos (archivos) desde la PC"
    }
  ],
  "lastModified": "2026-06-17T02:49:01.093",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ipear_project:ipear:0.6.14:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "351B7FE7-18A0-4338-9920-E90415992C0A"
            },
            {
              "criteria": "cpe:2.3:a:ipear_project:ipear:0.6.15:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "95962A24-A98D-4684-89EC-FA179A7D13A0"
            },
            {
              "criteria": "cpe:2.3:a:ipear_project:ipear:0.7.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1149C148-D414-45A8-A19E-AFBEE683AFD8"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}