CVE-2020-7615 describes a command injection vulnerability in fsa versions up to 0.5.1, specifically affecting the 'fsa_project' and 'fsa' products. An attacker can exploit this by manipulating the first argument of the 'execGitCommand()' function in 'lib/rep.js#63' to inject and execute arbitrary commands due to a lack of input sanitization. This vulnerability carries a CVSS score of 7.8 (High), indicating a significant risk. It requires local access and low privileges (AV:L/PR:L), but successful exploitation can lead to high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H). The attack complexity is low, making it relatively easy to exploit once access is gained. Currently, there is no evidence of active exploitation, and it is not listed in the KEV catalog. There are no known public exploit modules (Metasploit, Nuclei, ExploitDB), and it has received minimal community discussion or media coverage, suggesting a low profile in the threat landscape.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 0.5.1CPE matchmatch criteria | cpe:2.3:a:fsa_project:fsa:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.