CVE-2020-7696

This affects all versions of package react-native-fast-image. When an image with source={{uri: "...", headers: { host: "somehost.com", authorization: "..." }} is loaded, all other subsequent images will use the same headers, this can lead to signing credentials or other session tokens being leaked to other servers.

CVSS v3 5.3 MEDIUM
CVSS v2.0 5.0 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://github.com/DylanVann/react-native-fast-image/issues/690	Exploit Third Party Advisory
https://github.com/DylanVann/react-native-fast-image/pull/691	Exploit Issue Tracking Third Party Advisory
https://snyk.io/vuln/SNYK-JS-REACTNATIVEFASTIMAGE-572228	Exploit Patch Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:react-native-fast-image_project:react-native-fast-image:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2020-07-17 10:15

Updated : 2024-02-28 17:47

NVD link : CVE-2020-7696

Mitre link : CVE-2020-7696

CVE.ORG link : CVE-2020-7696

JSON object : View

Products Affected

react-native-fast-image_project

react-native-fast-image

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

{"id": "CVE-2020-7696", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "report@snyk.io", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2020-07-17T10:15:12.467", "references": [{"url": "https://github.com/DylanVann/react-native-fast-image/issues/690", "tags": ["Exploit", "Third Party Advisory"], "source": "report@snyk.io"}, {"url": "https://github.com/DylanVann/react-native-fast-image/pull/691", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "source": "report@snyk.io"}, {"url": "https://snyk.io/vuln/SNYK-JS-REACTNATIVEFASTIMAGE-572228", "tags": ["Exploit", "Patch", "Third Party Advisory"], "source": "report@snyk.io"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "This affects all versions of package react-native-fast-image. When an image with source={{uri: \"...\", headers: { host: \"somehost.com\", authorization: \"...\" }} is loaded, all other subsequent images will use the same headers, this can lead to signing credentials or other session tokens being leaked to other servers."}, {"lang": "es", "value": "Esto afecta a todas las versiones del paquete react-native-fast-image. Cuando una imagen es cargada con source={{uri: \"...\", headers: { host: \"somehost.com\", authorization: \"...\" }}, todas las dem\u00e1s im\u00e1genes posteriores usar\u00e1n los mismos encabezados, esto puede conllevar a una firma de credenciales u otros tokens de sesi\u00f3n que han sido filtrados a otros servidores"}], "lastModified": "2020-07-22T17:42:33.953", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:react-native-fast-image_project:react-native-fast-image:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "08F2A94F-6529-4117-B798-A6B5741CC615"}], "operator": "OR"}]}], "sourceIdentifier": "report@snyk.io"}