‹ Volver al listado

CVE-2020-5282

Estado: ModificadaCrítica (9.8)—
Gravedad9.8Crítica · CVSS 3.1
Probabilidad de explotación1.17 %mayor que el 67 % de las CVE
Explotación activaNono figura en el catálogo de CISA
Exploit públicoNo conocidosin código público localizado

En Nick Chan Bot versiones anteriores a 1.0.0-beta, se presenta una vulnerabilidad en el comando "npm" el cual es parte de este paquete de software. Esto permite una ejecución de shell arbitraria, lo que puede comprometer al bot. Esto se parcheó en la versión 1.0.0-beta.

CVSS

Puntuación base
9.8
Versión
3.1
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días
1.17 %
Percentil entre todas las CVEs puntuadas
67
Fecha de la puntuación
23/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Nick Chan BOT Project — Nick Chan BOT

CWE

Referencias

Mostrar las 4 referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-5282",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 7.2,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.8,
        "exploitabilityScore": 0.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "Nick Chan",
          "product": "nickchanbot",
          "versions": [
            {
              "status": "affected",
              "version": "< 1.0.0-beta"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-03-25T19:15:15.980",
  "references": [
    {
      "url": "https://github.com/Assfugil/nickchanbot/commit/d7dc87523fc8bb6babbf8d636c339193b236a3ba",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/Assfugil/nickchanbot/security/advisories/GHSA-8xwp-r7pj-cgw3",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/Assfugil/nickchanbot/commit/d7dc87523fc8bb6babbf8d636c339193b236a3ba",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/Assfugil/nickchanbot/security/advisories/GHSA-8xwp-r7pj-cgw3",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In Nick Chan Bot before version 1.0.0-beta there is a vulnerability in the `npm` command which is part of this software package. This allows arbitrary shell execution,which can compromise the bot This is patched in version 1.0.0-beta"
    },
    {
      "lang": "es",
      "value": "En Nick Chan Bot versiones anteriores a 1.0.0-beta, se presenta una vulnerabilidad en el comando \"npm\" el cual es parte de este paquete de software. Esto permite una ejecución de shell arbitraria, lo que puede comprometer al bot. Esto se parcheó en la versión 1.0.0-beta."
    }
  ],
  "lastModified": "2026-06-17T03:21:11.823",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:nick_chan_bot_project:nick_chan_bot:1.0.0:beta_pre_11:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "11AC2378-8131-44F0-8347-5BEBEABC4A99"
            },
            {
              "criteria": "cpe:2.3:a:nick_chan_bot_project:nick_chan_bot:1.0.0:beta_pre_7:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "91A429D2-B851-4611-866D-CD39841C4119"
            },
            {
              "criteria": "cpe:2.3:a:nick_chan_bot_project:nick_chan_bot:1.0.0:beta_pre_8:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5EC0F894-0755-49AD-ADB5-B410838E0E22"
            },
            {
              "criteria": "cpe:2.3:a:nick_chan_bot_project:nick_chan_bot:1.0.0:beta_pre_9:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1BB1D112-3880-410B-8E30-D66F9956FC13"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}