PatchTheCVECVE-2020-7712: This affects the package json before 10.0.0
52
This month
HIGH 7.2UPGRADEDOWNGRADEDOWNGRADE
CVE-2020-7712 is a high-severity flaw (CVSS 7.2) affecting json, commerce guided search, financial services crime and compliance management studio. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
This affects the package json before 10.0.0. It is possible to inject arbritary commands using the parseLookup function.
Why this priority
- High severity
- Public exploit reference
A fixed release or distro patch exists.
Risk facts
| CVSS score | 7.2 (High) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | High |
| User interaction | None |
| EPSS exploit chance | 3.1% (top 12%) |
| CISA exploited list | No |
| Weakness | CWE-78 |
| Published | 2020-08-30 |
| Last modified | 2026-10-08 |
Last updated 2026-10-08 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
joyent json UPGRADE
Affected: < 10.0.0
Fixed in: 10.0.0
Safe to downgrade to: no unaffected older release
1. Check installed version
npm ls json
2. UPGRADE to 10.0.0
npm install json@">=10.0.0"
oracle commerce guided search DOWNGRADE
Affected: 11.3.2
Fixed in: no fixed release known
Safe to downgrade to: a release before 11.3.2
1. Check installed version
apt-cache policy commerce-guided-search || rpm -q commerce-guided-search || commerce-guided-search --version
2. No fixed release: DOWNGRADE to a release before 11.3.2 (Debian / Ubuntu)
apt-cache madison commerce-guided-search
sudo apt install commerce-guided-search=<VERSION_BEFORE_11.3.2>
sudo apt-mark hold commerce-guided-search
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list commerce-guided-search
sudo dnf downgrade commerce-guided-search-<VERSION_BEFORE_11.3.2>
sudo dnf versionlock add commerce-guided-search
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
oracle financial services crime and compliance management studio DOWNGRADE
Affected: 8.0.8.2.0 · 8.0.8.3.0
Fixed in: no fixed release known
Safe to downgrade to: a release before 8.0.8.2.0
1. Check installed version
apt-cache policy financial-services-crime-and-compliance-management-studio || rpm -q financial-services-crime-and-compliance-management-studio || financial-services-crime-and-compliance-management-studio --version
2. No fixed release: DOWNGRADE to a release before 8.0.8.2.0 (Debian / Ubuntu)
apt-cache madison financial-services-crime-and-compliance-management-studio
sudo apt install financial-services-crime-and-compliance-management-studio=<VERSION_BEFORE_8.0.8.2.0>
sudo apt-mark hold financial-services-crime-and-compliance-management-studio
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list financial-services-crime-and-compliance-management-studio
sudo dnf downgrade financial-services-crime-and-compliance-management-studio-<VERSION_BEFORE_8.0.8.2.0>
sudo dnf versionlock add financial-services-crime-and-compliance-management-studio
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
oracle financial services regulatory reporting with agilereporter DOWNGRADE
Affected: 8.0.9.6.3
Fixed in: no fixed release known
Safe to downgrade to: a release before 8.0.9.6.3
1. Check installed version
apt-cache policy financial-services-regulatory-reporting-with-agilereporter || rpm -q financial-services-regulatory-reporting-with-agilereporter || financial-services-regulatory-reporting-with-agilereporter --version
2. No fixed release: DOWNGRADE to a release before 8.0.9.6.3 (Debian / Ubuntu)
apt-cache madison financial-services-regulatory-reporting-with-agilereporter
sudo apt install financial-services-regulatory-reporting-with-agilereporter=<VERSION_BEFORE_8.0.9.6.3>
sudo apt-mark hold financial-services-regulatory-reporting-with-agilereporter
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list financial-services-regulatory-reporting-with-agilereporter
sudo dnf downgrade financial-services-regulatory-reporting-with-agilereporter-<VERSION_BEFORE_8.0.9.6.3>
sudo dnf versionlock add financial-services-regulatory-reporting-with-agilereporter
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
oracle timesten in-memory database UPGRADE
Affected: < 21.1.1.1.0
Fixed in: 21.1.1.1.0
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy timesten-in-memory-database || rpm -q timesten-in-memory-database || timesten-in-memory-database --version
2. UPGRADE to 21.1.1.1.0 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade timesten-in-memory-database
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade timesten-in-memory-database
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2020-7712?
json: upgrade to 10.0.0; commerce guided search: downgrade or apply the listed mitigation; financial services crime and compliance management studio: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2020-7712 being exploited?
CVE-2020-7712 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2020-7712 affect?
CVE-2020-7712 affects json, commerce guided search, financial services crime and compliance management studio. Severity is high (CVSS 7.2). This affects the package json before 10.0.0. It is possible to inject arbritary commands using the parseLookup function.
How urgent is CVE-2020-7712?
Priority 52/100. High severity; Public exploit reference
Related CVEs
- CVE-2026-33210 CRITICAL 9.1 UPGRADE Ruby JSON is a JSON implementation for Ruby
- CVE-2020-10663 HIGH 7.5 UPGRADE MITIGATE The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6