CVE-2020-27637 — Path Traversal in Cran

CWE-22 — Path Traversal4 documents4 sources
Severity
9.8CRITICALNVD
EPSS
0.8%
top 26.32%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
R-project CranDebian R-base
Timeline
PublishedJan 12
Latest updateMay 24

Description

The R programming language’s default package manager CRAN is affected by a path traversal vulnerability that can lead to server compromise. This vulnerability affects packages installed via the R CMD install cli command or the install.packages() function from the interpreter. Update to version 4.0.3

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages2 packages

▶NVDr-project/cran< 4.0.3
▶debiandebian/r-base< r-base 4.0.3-1 (bookworm)

🔴Vulnerability Details

2
GHSA
GHSA-vw79-85j5-c56w: The R programming language’s default package manager CRAN is affected by a path traversal vulnerability that can lead to server compromise↗2022-05-24
▶
OSV
CVE-2020-27637: The R programming language’s default package manager CRAN is affected by a path traversal vulnerability that can lead to server compromise↗2021-01-12
▶

📋Vendor Advisories

1
Debian
CVE-2020-27637: r-base - The R programming language’s default package manager CRAN is affected by a path ...↗2020
▶