CVE-2020-15690

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

In Nim before 1.2.6, the standard library asyncftpclient lacks a check for whether a message contains a newline character.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.openwall.com/lists/oss-security/2021/02/04/3Exploit, Mailing List, Third Party Advisory
https://consensys.net/diligence/vulnerabilities/nim-asyncftpd-crlf-injection/Exploit, Third Party Advisory
https://github.com/nim-lang/Nim/blob/dc5a40f3f39c6ea672e6dc6aca7f8118a69dda99/lib/pure/asyncftpclient.nim#L145Exploit, Third Party Advisory
https://github.com/nim-lang/Nim/compare/v1.2.4...v1.2.6Patch, Third Party Advisory
https://github.com/tintinweb/pub/tree/master/pocs/cve-2020-15690Exploit, Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/02/04/3Exploit, Mailing List, Third Party Advisory
https://consensys.net/diligence/vulnerabilities/nim-asyncftpd-crlf-injection/Exploit, Third Party Advisory
https://github.com/nim-lang/Nim/blob/dc5a40f3f39c6ea672e6dc6aca7f8118a69dda99/lib/pure/asyncftpclient.nim#L145Exploit, Third Party Advisory
https://github.com/nim-lang/Nim/compare/v1.2.4...v1.2.6Patch, Third Party Advisory
https://github.com/tintinweb/pub/tree/master/pocs/cve-2020-15690Exploit, Third Party Advisory

Timeline

Published: Jan 30, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-156929.8In Nim 1.2.4, the standard library browsers mishandles the URL argument to browsers.openDefaultBrowser. This argument can be a local file pa CVE-2020-156936.5In Nim 1.2.4, the standard library httpClient is vulnerable to a CR-LF injection in the target URL. An injection is possible if the attacker CVE-2020-156947.5In Nim 1.2.4, the standard library httpClient fails to properly validate the server response. For example, httpClient.get().contentLength() CVE-2020-156956.3An issue was discovered in Joomla! through 3.9.19. A missing token check in the remove request section of com_privacy causes a CSRF vulnerab CVE-2020-156966.1An issue was discovered in Joomla! through 3.9.19. Lack of input filtering and escaping allows XSS attacks in mod_random_image.CVE-2020-156974.3An issue was discovered in Joomla! through 3.9.19. Internal read-only fields in the User table class could be modified by users.CVE-2020-156985.3An issue was discovered in Joomla! through 3.9.19. Inadequate filtering on the system information screen could expose Redis or proxy credent CVE-2020-156995.3An issue was discovered in Joomla! through 3.9.19. Missing validation checks on the usergroups table object can result in a broken site conf CVE-2020-15707.5A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer. The vulner CVE-2020-157006.3An issue was discovered in Joomla! through 3.9.19. A missing token check in the ajax_install endpoint of com_installer causes a CSRF vulnera CVE-2020-157015.5An unhandled exception in check_ignored() in apport/report.py can be exploited by a local attacker to cause a denial of service. If the mtim CVE-2020-157027.0TOCTOU Race Condition vulnerability in apport allows a local attacker to escalate privileges and execute arbitrary code. An attacker may exi