50
CVE-2020-7699
PoC ×2—CVSS 3.1
9.8 critical
EPSS
5%p91
Published
()
Modified
Description
This affects the package express-fileupload before 1.1.8. If the parseNested option is enabled, sending a corrupt HTTP request can lead to denial of service or arbitrary code execution.
- Vendors
- express-fileupload projectnetapp
- Products
- express-fileupload, max data
- Weakness
- CWE-1321
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H