CVE-2020-13110

The kerberos package before 1.0.0 for Node.js allows arbitrary code execution and privilege escalation via injection of malicious DLLs through use of the kerberos_sspi LoadLibrary() method, because of a DLL path search.

CVSS v3.1 NVD

7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

6.9 MEDIUMAV:L/AC:M/Au:N/C:C/I:C/A:C

EPSS

0.74% chance of exploitation in the next 30 days, 54th percentile

Published

2020-05-16

Updated

2024-08-04

Proof-of-concept exploits (1)

• https://www.op-c.net/2020/05/15/dll-injection-attack-in-kerberos-npm-package/

Security advisories

• https://www.linkedin.com/posts/op-innovate_dll-injection-attack-in-kerberos-npm-package-a…
• https://www.npmjs.com/advisories/1514
• https://www.op-c.net/2020/05/15/dll-injection-attack-in-kerberos-npm-package
• advisories/GHSA-m2mx-rfpw-jghv

References

• CVE Record
• NVD entry