CVE-2020-10800

HIGH

lix < 15.8.7 - Remote Code Execution via Man-in-the-Middle Location Header Injection

Title source: manual

Description

lix through 15.8.7 allows man-in-the-middle attackers to execute arbitrary code by modifying the HTTP client-server data stream so that the Location header is associated with attacker-controlled executable content in the postDownload field.

References (1)

Core 1

Core References

Third Party Advisory x_refsource_misc

https://www.npmjs.com/advisories/1306

Scores

CVSS v3 8.1

EPSS 0.0137

EPSS Percentile 68.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

Status published

Products (2)

lix_project/lix < 15.8.7

npm/lix 0npm

Published Mar 21, 2020

Tracked Since Feb 18, 2026