CVE-2020-8137
CRITICALCVSS 9.8/10EPSS 4.16%
Last modified
CVE-2020-8137 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. Code injection vulnerability in blamer 1.0.0 and earlier may result in remote code execution when the input can be controlled by an attacker.. EPSS estimates a 4.16% chance of exploitation in the next 30 days.
Description
Code injection vulnerability in blamer 1.0.0 and earlier may result in remote code execution when the input can be controlled by an attacker.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Blamer Project | Blamer | < 1.0.1 |
References
- https://hackerone.com/reports/772448Exploit, Patch, Third Party Advisory
- https://hackerone.com/reports/772448Exploit, Patch, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2020-8137?
Code injection vulnerability in blamer 1.0.0 and earlier may result in remote code execution when the input can be controlled by an attacker.
How severe is CVE-2020-8137?
CVE-2020-8137 has a CVSS score of 9.8/10 (CRITICAL severity). The EPSS model estimates a 4.16% probability of exploitation in the next 30 days.
How do I fix CVE-2020-8137?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2020
- CVE-2020-8131Arbitrary filesystem write vulnerability in Yarn before 1.22…7.5
- CVE-2020-8132Lack of input validation in pdf-image npm package version <=…9.8
- CVE-2020-8133A wrong generation of the passphrase for the encrypted block…5.3
- CVE-2020-8134Server-side request forgery (SSRF) vulnerability in Ghost CM…8.1
- CVE-2020-8135The uppy npm package < 1.9.3 is vulnerable to a Server-Side …9.8
- CVE-2020-8136Prototype pollution vulnerability in fastify-multipart < 1.0…7.5
- CVE-2020-8138A missing check for IPv4 nested inside IPv6 in Nextcloud ser…6.5
- CVE-2020-8139A missing access control check in Nextcloud Server < 18.0.1,…6.5
- CVE-2020-8140A code injection in Nextcloud Desktop Client 2.6.2 for macOS…6.7
- CVE-2020-8141The dot package v1.1.2 uses Function() to compile templates.…8.8
- CVE-2020-8142A security restriction bypass vulnerability has been discove…6.8
- CVE-2020-8143An Open Redirect vulnerability was discovered in Revive Adse…6.1
Are you affected by CVE-2020-8137?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST