CVE-2020-7598: opensuse leap

Modified

AliasesSUSE-RU-2020:1238-1UBUNTU-CVE-2020-7598DEBIAN-CVE-2020-7598+5 more

Published 11-03-2020Last modified 08-10-2026

Vulnerability summary

CVE-2020-7598 is a medium (CVSS 6.8) vulnerability in opensuse leap. EPSS estimates a 1.93% chance of exploitation in the next 30 days, higher than 80% of scored vulnerabilities. 1 public exploit is recorded.

Priority

Routine

Not severe (CVSS 5.6, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

6.8/10

010

Medium · v2.0 (NVD)

EPSS score

1.93%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits1reference

Advisory lineage

Upstream 0 · Downstream 17 · Related 7

OPENSUSE-SU-2020:0802-1 RHSA-2020:2362 RHSA-2020:2847 RHSA-2020:2848 RHSA-2020:2849 RHSA-2020:2852+11 more

Timeline

11-03-2020
PublishedVulnerability first disclosed.
08-10-2026
Last modifiedVulnerability information updated.

Description

minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "__proto__" payload.

CVSS metrics

6 scores · 5 sources · 2 versions

v3.15.6v2.06.8

EPSS trend

Probability

1.93%

Chance of exploitation in the next 30 days

Percentile

80%

Versus all other CVEs

30-day change

No change 0.00 pp

From 1.93% on 05-10-2026

05-10-202604-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found

referenceUnverified
Exploit Reference (snyk.io)
Maturity: unknown

Weaknesses

CWE · root cause

CWE-1321Improperly Controlled Modification of Object Prototype AttributesThe product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Suse34 products

branch-network-formula&distro=SUSE Manager Server Module 4.0< 0.1.1583842676.2fc2fa6-3.13.2
cobbler&distro=SUSE Manager Server Module 4.0< 3.0.0+git20190806.32c4bae0-7.10.2
dhcpd-formula&distro=SUSE Manager Server Module 4.0< 0.1.1583829431.db6edda-3.11.2
grafana-formula&distro=SUSE Manager Server Module 4.0< 0.2-4.7.2
image-sync-formula&distro=SUSE Manager Server Module 4.0< 0.1.1585064259.12b97ef-3.14.2

openvpn-formula&distro=SUSE Manager Server Module 4.0< 0.1-4.3.1
patterns-suse-manager&distro=SUSE Manager Proxy Module 4.0< 4.0-9.13.2
patterns-suse-manager&distro=SUSE Manager Server Module 4.0< 4.0-9.13.2
prometheus-formula&distro=SUSE Manager Server Module 4.0< 0.2-4.10.2
pxe-formula&distro=SUSE Manager Server Module 4.0< 0.1.1586937953.e458f5c-3.14.2
py26-compat-salt&distro=SUSE Manager Server Module 4.0< 2016.11.10-10.14.2
python-susemanager-retail&distro=SUSE Manager Server Module 4.0< 1.0.1583842676.2fc2fa6-3.16.2
saltboot-formula&distro=SUSE Manager Server Module 4.0< 0.1.1587051918.6bc9e88-3.10.2
spacewalk-backend&distro=SUSE Manager Proxy Module 4.0< 4.0.31-3.26.3
spacewalk-backend&distro=SUSE Manager Server Module 4.0< 4.0.31-3.26.3
spacewalk-certs-tools&distro=SUSE Manager Proxy Module 4.0< 4.0.16-3.18.2
spacewalk-certs-tools&distro=SUSE Manager Server Module 4.0< 4.0.16-3.18.2
spacewalk-client-tools&distro=SUSE Manager Proxy Module 4.0< 4.0.13-3.16.2
spacewalk-client-tools&distro=SUSE Manager Server Module 4.0< 4.0.13-3.16.2
spacewalk-java&distro=SUSE Manager Server Module 4.0< 4.0.32-3.26.2
spacewalk-proxy-installer&distro=SUSE Manager Proxy Module 4.0< 4.0.12-3.3.2
spacewalk-utils&distro=SUSE Manager Server Module 4.0< 4.0.17-3.18.2
spacewalk-web&distro=SUSE Manager Proxy Module 4.0< 4.0.20-3.21.3
spacewalk-web&distro=SUSE Manager Server Module 4.0< 4.0.20-3.21.3
spacewalk&distro=SUSE Manager Server Module 4.0< 4.0.5-3.3.2
susemanager-doc-indexes&distro=SUSE Manager Server Module 4.0< 4.0-10.21.2
susemanager-docs_en&distro=SUSE Manager Server Module 4.0< 4.0-10.21.2
susemanager-schema&distro=SUSE Manager Server Module 4.0< 4.0.19-3.20.2
susemanager-sls&distro=SUSE Manager Server Module 4.0< 4.0.25-3.20.2
susemanager-tftpsync-recv&distro=SUSE Manager Proxy Module 4.0< 4.0.6-3.3.2
susemanager-tftpsync&distro=SUSE Manager Server Module 4.0< 4.0.6-3.3.2
susemanager&distro=SUSE Manager Server Module 4.0< 4.0.23-3.23.3
virtual-host-gatherer&distro=SUSE Manager Server Module 4.0< 1.0.20-3.6.2
virtualization-host-formula&distro=SUSE Manager Server Module 4.0< 0.3-4.6.2

Show all 34

Chainguard1 product

scanner-test-npm-vulnerability-unfixedAll versions (No fix recorded)

Debian1 product

node-minimist< 1.2.5-1

Npm1 product

minimist< 0.2.1 | ≥ 1.0.0, < 1.2.3

Opensuse1 product

leapEOL15.1

Substack1 product

minimist< 1.2.2

Ubuntu1 product

node-minimistAll versions (No fix recorded)

7 vendors · 40 products

References

50 links

snyk.io/vuln/SNYK-JS-MINIMIST-559764X Refsource MISCREPORTWEBFIXExploitPatchThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2020-06/msg00024.htmlVendor AdvisoryX Refsource SUSEWEBAdvisoryMailing ListThird Party Advisory
www.suse.com/support/update/announcement/-2020-1238/suse-ru-20201238-1/Advisory
bugzilla.suse.com/1151683REPORT
bugzilla.suse.com/1158463REPORT
bugzilla.suse.com/1158752REPORT
bugzilla.suse.com/1159010REPORT
bugzilla.suse.com/1159184REPORT
bugzilla.suse.com/1159202REPORT
bugzilla.suse.com/1160246REPORT

Show all 50 references

bugzilla.suse.com/1163001REPORT
bugzilla.suse.com/1163121REPORT
bugzilla.suse.com/1163468REPORT
bugzilla.suse.com/1163538REPORT
bugzilla.suse.com/1163884REPORT
bugzilla.suse.com/1164111REPORT
bugzilla.suse.com/1164121REPORT
bugzilla.suse.com/1164563REPORT
bugzilla.suse.com/1164771REPORT
bugzilla.suse.com/1164875REPORT
bugzilla.suse.com/1165571REPORT
bugzilla.suse.com/1165921REPORT
bugzilla.suse.com/1165926REPORT
bugzilla.suse.com/1166408REPORT
bugzilla.suse.com/1166523REPORT
bugzilla.suse.com/1166613REPORT
bugzilla.suse.com/1166699REPORT
bugzilla.suse.com/1167052REPORT
bugzilla.suse.com/1167237REPORT
bugzilla.suse.com/1167329REPORT
bugzilla.suse.com/1167556REPORT
bugzilla.suse.com/1167777REPORT
bugzilla.suse.com/1168069REPORT
bugzilla.suse.com/1168083REPORT
bugzilla.suse.com/1168227REPORT
bugzilla.suse.com/1168696REPORT
bugzilla.suse.com/1169109REPORT
bugzilla.suse.com/1169144REPORT
bugzilla.suse.com/1169865REPORT
www.suse.com/security/cve/CVE-2020-7598WEB
ubuntu.com/security/CVE-2020-7598REPORT
www.cve.org/CVERecord?id=CVE-2020-7598REPORT
security-tracker.debian.org/tracker/CVE-2020-7598Advisory
nvd.nist.gov/vuln/detail/CVE-2020-7598Advisory
github.com/minimistjs/minimist/commit/10bd4cdf49d9686d48214be9d579a9cdfda37c68WEB
github.com/minimistjs/minimist/commit/38a4d1caead72ef99e824bb420a2528eec03d9abWEB
github.com/minimistjs/minimist/commit/4cf1354839cb972e38496d35e12f806eea92c11fWEB
github.com/minimistjs/minimist/commit/63e7ed05aa4b1889ec2f3b196426db4500cbda94WEB
github.com/substack/minimistPACKAGE
www.npmjs.com/advisories/1179WEB