CVSS 3.1
7.8 highCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HCVE-2020-13110
High (7.8) in kerberos project kerberos. EPSS 0.7% chance of exploitation in the next 30 days. Fixed in kerberos 1.0.0.
The kerberos package before 1.0.0 for Node.js allows arbitrary code execution and privilege escalation via injection of malicious DLLs through use of the kerberos_sspi LoadLibrary() method, because of a DLL path search.
Severity
- EPSS
- 0.7% chance of exploitation in the next 30 days; higher than 54% of CVEs (scores of 2026-10-31)
- CWE
- CWE-427
- Published
- Modified
- Record from
- the NVD, synced
Affected
- kerberos_project:kerberos
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-m2mx-rfpw-jghv | npm | kerberos | <1.0.0 | 1.0.0 |
References
- https://medium.com/%40kiddo_Ha3ker/dll-injection-attack-in-kerberos-npm-package-cb4b32031cd
- https://www.linkedin.com/posts/op-innovate_dll-injection-attack-in-kerberos-npm-package-activity-6667043749547253760-kVlW
- https://www.npmjs.com/advisories/1514
- https://www.op-c.net/2020/05/15/dll-injection-attack-in-kerberos-npm-package/
- https://medium.com/%40kiddo_Ha3ker/dll-injection-attack-in-kerberos-npm-package-cb4b32031cd