CVE-2020-36911

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2020-36911

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-36911.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2020-36911

Published

2026-01-13T23:15:48.437Z

Modified

2026-03-14T14:47:40.169571Z

Severity

9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator

Summary

[none]

Details

Covenant 0.1.3 - 0.5 contains a remote code execution vulnerability that allows attackers to craft malicious JWT tokens with administrative privileges. Attackers can generate forged tokens with admin roles and upload custom DLL payloads to execute arbitrary commands on the target system.

References

Affected packages

Git / github.com/cobbr/covenant

Affected ranges

Type

GIT

Repo

https://github.com/cobbr/covenant

Events

Introduced

5f28606ae43b1b3e9aceb3290bac1fa45990371c

Last affected

79c45e77e95b4010f9676e34aacae3d18bbb5df0

Database specific

{
    "versions": [
        {
            "introduced": "0.1.3"
        },
        {
            "last_affected": "0.5"
        }
    ]
}

Affected versions

v0.*

v0.1.3

v0.2

v0.3

v0.3.1

v0.3.2

v0.4

v0.5

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-36911.json"