Vulnerability in I18n Project
CVE-2020-7791
This affects the package i18n before 2.1.15. Vulnerability arises out of insufficient handling of erroneous language tags in src/i18n/Concrete/TextLocalizer.cs and src/i18n/LocalizedApplication.cs.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.030 (86.9th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 87th percentile — 86.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.030 · newest: 0.030 · change: +0.000
Affected products
- I18n Project
- I18n — versions unspecified
Public proof-of-concept exploits
References
- snyk.io/vuln/SNYK-DOTNET-I18N-1050179 (Third Party Advisory)
- github.com/turquoiseowl/i18n/issues/387 (Third Party Advisory, Issue Tracking)
- github.com/turquoiseowl/i18n/commit/c418e3345313dc896c1951d8c46ab0b9b12fcbd3 (Patch, Third Party Advisory)
- lists.apache.org/thread.html/rc2abba7aa0450198494bbee654fce9b97fad72a4989323e18… (mailing-list)
- lists.apache.org/thread.html/r33dc233634aedb04fa77db3eb79ea12d15ca4da89fa46a1c5… (mailing-list)
- lists.apache.org/thread.html/r9744574911e7e4edf5f4eeae92a4ccc83e3723cec93795006… (mailing-list)
- lists.apache.org/thread.html/r394b1ae54693609a60ea8aab02ff045dc92f593aa3aebff56… (mailing-list)
- lists.apache.org/thread.html/r2667286c8ceffaf893b16829b9612d8f7c4ee6b30362c6c1b… (mailing-list)
- lists.apache.org/thread.html/ra5047392edf1fecba441c9adc8807ed6c5f7d2cc71f2f3bb8… (mailing-list)
- lists.apache.org/thread.html/rc850d0fce066f9eb9e8553172d9207bad7df4d2059d93abc5… (mailing-list)
Frequently asked questions
- What is CVE-2020-7791?
- CVE-2020-7791 is a high-severity vulnerability in I18n Project. CVSS score: 7.5/10. Published 2020-12-11.
- How severe is CVE-2020-7791?
- High severity. CVSS v3 base score is 7.5 out of 10.
- Is CVE-2020-7791 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.