What’s Vulnerable › Vulnerabilities
CVE-2020-7712: Command Injection
- Severity: high (CVSS 7.2 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 3.1% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2020-08-30 · updated 2026-10-08
- Weakness: CWE-78
Description
This affects the package json before 10.0.0. It is possible to inject arbritary commands using the parseLookup function.
Affected products
- Joyent Json: before 10.0.0 — fixed in 10.0.0
- Oracle Corporation Oracle Commerce Guided Search / Oracle Commerce Experience Manager: 11.3.2
- Oracle Financial Services Crime And Compliance Management Studio: 8.0.8.2.0, 8.0.8.3.0
- Oracle Financial Services Regulatory Reporting With Agilereporter: 8.0.9.6.3
- Oracle Corporation TimesTen In-Memory Database: before 21.1.1.1.0 — fixed in 21.1.1.1.0
How to fix
Upgrade to a fixed version: Joyent Json 10.0.0; Oracle Corporation TimesTen In-Memory Database 21.1.1.1.0. Check the vendor advisory for mitigations.
References
- https://github.com/trentm/json/issues/144
- https://github.com/trentm/json/pull/145
- https://lists.apache.org/thread.html/r37c0e1807da7ff2bdd028bbe296465a6bbb99e2320dbe661d5d8b33b%40%3Cissues.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/r3b04f4e99a19613f88ae088aa18cd271231a3c79dfff8f5efa8cda61%40%3Cissues.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/r5f17bfca1d6e7f4b33ae978725b2fd62a9f1b3111696eafa9add802d%40%3Cissues.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/r8d2e174230f6d26e16c007546e804c343f1f68956f526daaafa4aaae%40%3Cdev.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/r977a907ecbedf87ae5ba47d4c77639efb120f74d4d1b3de14a4ef4da%40%3Cissues.flink.apache.org%3E
- https://lists.apache.org/thread.html/r9c6d28e5b9a9b3481b7d1f90f1c2f75cd1a5ade91038426e0fb095da%40%3Cdev.flink.apache.org%3E
- https://lists.apache.org/thread.html/ra890c24b3d90be36daf48ae76b263acb297003db24c1122f8e4aaef2%40%3Cissues.flink.apache.org%3E
- https://lists.apache.org/thread.html/rb023d54a46da1ac0d8969097f5fecc79636b07d3b80db7b818a5c55c%40%3Cissues.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/rb2b981912446a74e14fe6076c4b7c7d8502727ea0718e6a65a9b1be5%40%3Cissues.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/rb89bd82dffec49f83b49e9ad625b1b63a408b3c7d1a60d6f049142a0%40%3Cissues.flink.apache.org%3E
Get alerted when CVE-2020-7712 or the next vulnerability affects your stack