title: Remote Code Execution vulnerability
description: Nette versions before 2.0.19, 2.1.13, 2.2.10, 2.3.14, 2.4.16, 3.0.6 are vulnerable to an code injection attack by passing specially formed parameters to URL that may possibly leading to RCE. Nette is a PHP/Composer MVC Framework.
problem types: CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
affected:
{
product: application
vendor: nette
versions:
status: affected, version: >= 2.0.0, < 2.0.19
status: affected, version: >= 2.1.0, < 2.1.13
status: affected, version: >= 2.2.0, < 2.2.10
status: affected, version: >= 2.3.0, < 2.3.14
status: affected, version: >= 2.4.0, < 2.4.16
status: affected, version: >= 3.0.0, < 3.0.6
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.7
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
version: 3.1
]