CVE-2020-13622

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

JerryScript 2.2.0 allows attackers to cause a denial of service (assertion failure) because a property key query for a Proxy object returns unintended data.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-617

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/jerryscript-project/jerryscript/issues/3787Third Party Advisory
https://github.com/jerryscript-project/jerryscript/pull/3797Third Party Advisory
https://github.com/jerryscript-project/jerryscript/issues/3787Third Party Advisory
https://github.com/jerryscript-project/jerryscript/pull/3797Third Party Advisory

Timeline

Published: May 27, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-136237.5JerryScript 2.2.0 allows attackers to cause a denial of service (stack consumption) via a proxy operation.CVE-2020-136257.5PHPMailer before 6.1.6 contains an output escaping bug when the name of a file attachment contains a double quote character. This can result CVE-2020-136264.6OnePlus App Locker through 2020-10-06 allows physically proximate attackers to use Google Assistant to bypass an authorization check in orde CVE-2020-136276.1Cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via the widgetId parameter to servic CVE-2020-136286.1Cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via the widgetId parameter to host-m CVE-2020-13637.8An elevation of privilege vulnerability exists when the Windows Picker Platform improperly handles memory.To exploit this vulnerability, an CVE-2020-136307.0ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the snippet feature.CVE-2020-136315.5SQLite before 3.32.0 allows a virtual table to be renamed to the name of one of its shadow tables, related to alter.c and build.c.CVE-2020-136325.5ext/fts3/fts3_snippet.c in SQLite before 3.32.0 has a NULL pointer dereference via a crafted matchinfo() query.CVE-2020-136336.1Fork before 5.8.3 allows XSS via navigation_title or title.CVE-2020-136347.8In Windows Master (aka Windows Optimization Master) 7.99.13.604, the driver file (WoptiHWDetect.SYS) allows local users to cause a denial of CVE-2020-136377.5An issue was discovered in the stashcat app through 3.9.2 for macOS, Windows, Android, iOS, and possibly other platforms. It stores the clie