CVE-2020-8174: netapp active_iq_unified_manager
Vulnerability summary
CVE-2020-8174 is a high (CVSS 9.3) vulnerability in netapp active_iq_unified_manager. EPSS estimates a 7.65% chance of exploitation in the next 30 days, higher than 94.5% of scored vulnerabilities. 1 public exploit is recorded.
Public exploit (reference, Date unknown)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 18 · Related 9Timeline
- 24-07-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
napi_get_value_string_*() allows various kinds of memory corruption in node < 10.21.0, 12.18.0, and < 14.4.0.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- NVDNIST8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
7.65%
Chance of exploitation in the next 30 days
Percentile
95%
Versus all other CVEs
30-day change
No change 0.00 pp
From 7.65% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (hackerone.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary.
- CWE-191Integer Underflow (Wrap or Wraparound)The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Netapp4 products
Oracle4 products
- banking_extensibility_workbench14.3.0 | 14.4.0
- blockchain_platform< 21.1.2
- mysql_cluster≤ 7.3.30 | ≥ 7.4.0, ≤ 7.4.29 | ≥ 7.5.0, ≤ 7.5.19 | ≥ 7.6.0, ≤ 7.6.15 | ≥ 8.0.0, ≤ 8.0.21
- retail_xstore_point_of_service16.0.6 | 17.0.4 | 18.0.3 | 19.0.2 | 20.0.1
Alpine2 products
- nodejs< 12.20.1-r0 | < 12.18.3-r0 | < 12.18.0-r0
- nodejs-current< 14.4.0-r0
Debian1 product
- nodejs< 10.21.0~dfsg-1
Nodejs1 product
- node.js< 10.21.0 | ≥ 12.0.0, < 12.18.0 | ≥ 14.0.0, < 14.4.0
Ubuntu1 product
- nodejs< 8.10.0~dfsg-2ubuntu0.4+esm2 | < 10.19.0~dfsg-3ubuntu1.1
6 vendors · 13 products
