CVE-2020-7712
published 2020-08-30CVE-2020-7712: This affects the package json before 10.0.0. It is possible to inject arbritary commands using the parseLookup function.
PriorityP343high7.2CVSS 3.1
AVNACLPRHUINSUCHIHAH
EPSS
3.11%
87.7th percentile
This affects the package json before 10.0.0. It is possible to inject arbritary commands using the parseLookup function.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| joyent | json | < 10.0.0 | 10.0.0 |
| joyent | json | >= 0 < 10.0.0 | 10.0.0 |
| joyent | json | >= unspecified < 10.0.0 | 10.0.0 |
| oracle | commerce_guided_search | — | — |
| oracle | financial_services_crime_and_compliance_management_studio | — | — |
| oracle | financial_services_crime_and_compliance_management_studio | — | — |
| oracle | financial_services_regulatory_reporting_with_agilereporter | — | — |
| oracle | timesten_in-memory_database | < 21.1.1.1.0 | 21.1.1.1.0 |
CVSS provenance
nvdv3.17.2HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
vendor_oracle7.2HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Oracle Commerce Guided Search 11.3.2 Framework/Experience Manager os command injection
vuldb·2026-10-11·CVSS 7.2
CVE-2020-7712 [HIGH] Oracle Commerce Guided Search 11.3.2 Framework/Experience Manager os command injection
A vulnerability, which was classified as critical, was found in Oracle Commerce Guided Search 11.3.2. Impacted is an unknown function of the component Framework/Experience Manager. Executing a manipulation can lead to os command injection.
This vulnerability is registered as CVE-2020-7712. It is possible to launch the attack remotely. No exploit is available.
You should upgrade the affected component.
VulDB
Oracle Financial Services Regulatory Reporting with AgileREPORTER Apache ZooKeeper os command injection
vuldb·2026-10-11·CVSS 7.2
CVE-2020-7712 [HIGH] Oracle Financial Services Regulatory Reporting with AgileREPORTER Apache ZooKeeper os command injection
A vulnerability was found in Oracle Financial Services Regulatory Reporting with AgileREPORTER 8.0.9.6.3. It has been rated as critical. This impacts an unknown function of the component Apache ZooKeeper. Performing a manipulation results in os command injection.
This vulnerability is reported as CVE-2020-7712. The attack is possible to be carried out remotely. No exploit exists.
Upgrading the affected component is advised.
VulDB
Oracle Financial Services Crime and Compliance Management Studio os command injection
vuldb·2026-10-11·CVSS 7.2
CVE-2020-7712 [HIGH] Oracle Financial Services Crime and Compliance Management Studio os command injection
A vulnerability classified as critical was found in Oracle Financial Services Crime and Compliance Management Studio 8.0.8.2.0/8.0.8.3.0. This affects an unknown function of the component Studio. Such manipulation leads to os command injection.
This vulnerability is traded as CVE-2020-7712. The attack may be launched remotely. There is no exploit available.
Upgrading the affected component is advised.
VulDB
Oracle Siebel CRM up to 22.5 Loging os command injection
vuldb·2026-10-11·CVSS 7.2
CVE-2020-7712 [HIGH] Oracle Siebel CRM up to 22.5 Loging os command injection
A vulnerability, which was classified as critical, has been found in Oracle Siebel CRM up to 22.5. The impacted element is an unknown function of the component Loging. This manipulation causes os command injection.
This vulnerability is tracked as CVE-2020-7712. The attack is possible to be carried out remotely. No exploit exists.
Applying a patch is the recommended action to fix this issue.
VulDB
Oracle TimesTen In-Memory Database TimesTen Infrastructure os command injection
vuldb·2026-10-11·CVSS 7.2
CVE-2020-7712 [HIGH] Oracle TimesTen In-Memory Database TimesTen Infrastructure os command injection
A vulnerability, which was classified as critical, was found in Oracle TimesTen In-Memory Database. Affected by this issue is some unknown functionality of the component TimesTen Infrastructure. The manipulation results in os command injection.
This vulnerability is reported as CVE-2020-7712. The attack can be launched remotely. No exploit exists.
You should upgrade the affected component.
GHSA
trentm/json vulnerable to command injection
ghsa·2021-05-06
CVE-2020-7712 [HIGH] CWE-78 trentm/json vulnerable to command injection
trentm/json vulnerable to command injection
This affects the package json before 10.0.0. It is possible to inject arbritary commands using the parseLookup function.
OSV
trentm/json vulnerable to command injection
osv·2021-05-06
CVE-2020-7712 [HIGH] trentm/json vulnerable to command injection
trentm/json vulnerable to command injection
This affects the package json before 10.0.0. It is possible to inject arbritary commands using the parseLookup function.
Oracle
Oracle Oracle Siebel CRM Risk Matrix: Loging (Apache ZooKeeper) — CVE-2020-7712
vendor_oracle·2023-04-15·CVSS 7.2
CVE-2020-7712 [HIGH] Oracle Oracle Siebel CRM Risk Matrix: Loging (Apache ZooKeeper) — CVE-2020-7712
Oracle Oracle Siebel CRM Risk Matrix: Loging (Apache ZooKeeper) vulnerability
CVE: CVE-2020-7712
CVSS: 7.2
Protocol: HTTP
Remote exploit: No
Affected versions: Network
Advisory: cpuapr2023 (APR 2023)
Oracle
Oracle Oracle Commerce Risk Matrix: Framework, Experience Manager (Apache ZooKeeper) — CVE-2020-7712
vendor_oracle·2022-07-15·CVSS 7.2
CVE-2020-7712 [HIGH] Oracle Oracle Commerce Risk Matrix: Framework, Experience Manager (Apache ZooKeeper) — CVE-2020-7712
Oracle Oracle Commerce Risk Matrix: Framework, Experience Manager (Apache ZooKeeper) vulnerability
CVE: CVE-2020-7712
CVSS: 7.2
Protocol: HTTP
Remote exploit: No
Affected versions: Network
Advisory: cpujul2022 (JUL 2022)
Oracle
Oracle Oracle TimesTen In-Memory Database Risk Matrix: TimesTen Infrastructure (Apache ZooKeeper) — CVE-2020-7712
vendor_oracle·2022-01-15·CVSS 7.2
CVE-2020-7712 [HIGH] Oracle Oracle TimesTen In-Memory Database Risk Matrix: TimesTen Infrastructure (Apache ZooKeeper) — CVE-2020-7712
Oracle Oracle TimesTen In-Memory Database Risk Matrix: TimesTen Infrastructure (Apache ZooKeeper) vulnerability
CVE: CVE-2020-7712
CVSS: 7.2
Protocol: HTTP
Remote exploit: No
Affected versions: Network
Advisory: cpujan2022 (JAN 2022)
Oracle
Oracle Oracle Financial Services Applications Risk Matrix: Reports (Apache ZooKeeper) — CVE-2020-7712
vendor_oracle·2021-07-15·CVSS 7.2
CVE-2020-7712 [HIGH] Oracle Oracle Financial Services Applications Risk Matrix: Reports (Apache ZooKeeper) — CVE-2020-7712
Oracle Oracle Financial Services Applications Risk Matrix: Reports (Apache ZooKeeper) vulnerability
CVE: CVE-2020-7712
CVSS: 7.2
Protocol: HTTP
Remote exploit: No
Affected versions: Network
Advisory: cpujul2021 (JUL 2021)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/trentm/json/issues/144https://github.com/trentm/json/pull/145https://lists.apache.org/thread.html/r37c0e1807da7ff2bdd028bbe296465a6bbb99e2320dbe661d5d8b33b%40%3Cissues.zookeeper.apache.org%3Ehttps://lists.apache.org/thread.html/r3b04f4e99a19613f88ae088aa18cd271231a3c79dfff8f5efa8cda61%40%3Cissues.zookeeper.apache.org%3Ehttps://lists.apache.org/thread.html/r5f17bfca1d6e7f4b33ae978725b2fd62a9f1b3111696eafa9add802d%40%3Cissues.zookeeper.apache.org%3Ehttps://lists.apache.org/thread.html/r8d2e174230f6d26e16c007546e804c343f1f68956f526daaafa4aaae%40%3Cdev.zookeeper.apache.org%3Ehttps://lists.apache.org/thread.html/r977a907ecbedf87ae5ba47d4c77639efb120f74d4d1b3de14a4ef4da%40%3Cissues.flink.apache.org%3Ehttps://lists.apache.org/thread.html/r9c6d28e5b9a9b3481b7d1f90f1c2f75cd1a5ade91038426e0fb095da%40%3Cdev.flink.apache.org%3Ehttps://lists.apache.org/thread.html/ra890c24b3d90be36daf48ae76b263acb297003db24c1122f8e4aaef2%40%3Cissues.flink.apache.org%3Ehttps://lists.apache.org/thread.html/rb023d54a46da1ac0d8969097f5fecc79636b07d3b80db7b818a5c55c%40%3Cissues.zookeeper.apache.org%3Ehttps://lists.apache.org/thread.html/rb2b981912446a74e14fe6076c4b7c7d8502727ea0718e6a65a9b1be5%40%3Cissues.zookeeper.apache.org%3Ehttps://lists.apache.org/thread.html/rb89bd82dffec49f83b49e9ad625b1b63a408b3c7d1a60d6f049142a0%40%3Cissues.flink.apache.org%3Ehttps://lists.apache.org/thread.html/rba7ea4d75d6a8e5b935991d960d9b893fd30e576c4d3b531084ebd7d%40%3Cissues.flink.apache.org%3Ehttps://lists.apache.org/thread.html/rd9b9cc843f5cf5b532bdad9e87a817967efcf52b917e8c43b6df4cc7%40%3Cissues.zookeeper.apache.org%3Ehttps://lists.apache.org/thread.html/rec8bb4d637b04575da41cfae49118e108e95d43bfac39b7b698ee4db%40%3Cissues.zookeeper.apache.org%3Ehttps://lists.apache.org/thread.html/ree3abcd33c06ee95ab59faa1751198a1186d8941ddc2c2562c12966c%40%3Cissues.zookeeper.apache.org%3Ehttps://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-608932https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-608931https://snyk.io/vuln/SNYK-JS-JSON-597481https://www.oracle.com//security-alerts/cpujul2021.htmlhttps://www.oracle.com/security-alerts/cpujan2022.htmlhttps://www.oracle.com/security-alerts/cpujul2022.htmlhttps://github.com/trentm/json/issues/144https://github.com/trentm/json/pull/145https://lists.apache.org/thread.html/r37c0e1807da7ff2bdd028bbe296465a6bbb99e2320dbe661d5d8b33b%40%3Cissues.zookeeper.apache.org%3Ehttps://lists.apache.org/thread.html/r3b04f4e99a19613f88ae088aa18cd271231a3c79dfff8f5efa8cda61%40%3Cissues.zookeeper.apache.org%3Ehttps://lists.apache.org/thread.html/r5f17bfca1d6e7f4b33ae978725b2fd62a9f1b3111696eafa9add802d%40%3Cissues.zookeeper.apache.org%3Ehttps://lists.apache.org/thread.html/r8d2e174230f6d26e16c007546e804c343f1f68956f526daaafa4aaae%40%3Cdev.zookeeper.apache.org%3Ehttps://lists.apache.org/thread.html/r977a907ecbedf87ae5ba47d4c77639efb120f74d4d1b3de14a4ef4da%40%3Cissues.flink.apache.org%3Ehttps://lists.apache.org/thread.html/r9c6d28e5b9a9b3481b7d1f90f1c2f75cd1a5ade91038426e0fb095da%40%3Cdev.flink.apache.org%3Ehttps://lists.apache.org/thread.html/ra890c24b3d90be36daf48ae76b263acb297003db24c1122f8e4aaef2%40%3Cissues.flink.apache.org%3Ehttps://lists.apache.org/thread.html/rb023d54a46da1ac0d8969097f5fecc79636b07d3b80db7b818a5c55c%40%3Cissues.zookeeper.apache.org%3Ehttps://lists.apache.org/thread.html/rb2b981912446a74e14fe6076c4b7c7d8502727ea0718e6a65a9b1be5%40%3Cissues.zookeeper.apache.org%3Ehttps://lists.apache.org/thread.html/rb89bd82dffec49f83b49e9ad625b1b63a408b3c7d1a60d6f049142a0%40%3Cissues.flink.apache.org%3Ehttps://lists.apache.org/thread.html/rba7ea4d75d6a8e5b935991d960d9b893fd30e576c4d3b531084ebd7d%40%3Cissues.flink.apache.org%3Ehttps://lists.apache.org/thread.html/rd9b9cc843f5cf5b532bdad9e87a817967efcf52b917e8c43b6df4cc7%40%3Cissues.zookeeper.apache.org%3Ehttps://lists.apache.org/thread.html/rec8bb4d637b04575da41cfae49118e108e95d43bfac39b7b698ee4db%40%3Cissues.zookeeper.apache.org%3Ehttps://lists.apache.org/thread.html/ree3abcd33c06ee95ab59faa1751198a1186d8941ddc2c2562c12966c%40%3Cissues.zookeeper.apache.org%3Ehttps://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-608932https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-608931https://snyk.io/vuln/SNYK-JS-JSON-597481https://www.oracle.com//security-alerts/cpujul2021.htmlhttps://www.oracle.com/security-alerts/cpujan2022.htmlhttps://www.oracle.com/security-alerts/cpujul2022.html
2020-08-30
Published