Moole Vulnerability Database

Find real vulnerabilities before they ship

Critical

CVE-2020-13756

Sabberworm PHP CSS Parser before 8.3.1 calls eval on uncontrolled data, possibly leading to remote code execution if the function allSelectors() or getSelectorsBySpecificity() is called with input from an attacker.

VectorNETWORK

PublishedJun 03, 2020, 14:15

Published Bycve@mitre.org

Base Score

Score9.8

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

sabberworm/php-css-parser(Packagist)8.3.08.3.1N/A

sabberworm/php-css-parser(Packagist)8.2.08.2.1N/A

sabberworm/php-css-parser(Packagist)8.1.08.1.1N/A

sabberworm/php-css-parser(Packagist)8.0.08.0.1N/A

sabberworm/php-css-parser(Packagist)7.0.07.0.4N/A

sabberworm/php-css-parser(Packagist)6.0.06.0.2N/A

sabberworm/php-css-parser(Packagist)5.2.05.2.1N/A

sabberworm/php-css-parser(Packagist)5.1.05.1.3N/A

sabberworm/php-css-parser(Packagist)5.0.05.0.9N/A

sabberworm/php-css-parser(Packagist)4.0.04.0.1N/A

sabberworm/php-css-parser(Packagist)3.0.03.0.1N/A

sabberworm/php-css-parser(Packagist)2.0.02.0.1N/A

sabberworm/php-css-parser(Packagist)1.0.01.0.1N/A

References

Weakness Type

CWE-94

CVSS Metrics

Base Score

9.8

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Base SeverityCritical

Version

3.1

Attack Vector (AV)

NETWORK