CVE-2017-16020

Summit is a node web framework. When using the PouchDB driver in the module, Summit 0.1.0 and later allows an attacker to execute arbitrary commands via the collection name.

Score

CVSS 3.1 9.8 Critical

Status

Modified - support@hackerone.com

Published

2018-06-04

Last modified

2024-09-16

Weaknesses

CWE-94

Affected products

• Summit Node Module (Hackerone)
• Summit (Summit Project)

References

• https://github.com/notduncansmith/summit/issues/23
• https://nodesecurity.io/advisories/315