CVE-2020-27887: 
EyesOfNetwork vulnerability analysis and mitigation

An authenticated web user vulnerability was discovered in EyesOfNetwork versions 5.3 through 5.3-8. The vulnerability allows authenticated users with sufficient privileges to abuse the AutoDiscovery module to execute arbitrary OS commands through the nmap_binary parameter in the lilac/autodiscovery.php file (NVD, CVE).

The vulnerability is classified as an OS Command Injection (CWE-78) issue. It has been assigned a CVSS v3.1 base score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating network accessibility, low attack complexity, and requiring low privileges. The CVSS v2.0 base score is 9.0 (HIGH) with vector (AV:N/AC:L/Au:S/C:C/I:C/A:C) (NVD).

The vulnerability allows attackers to execute arbitrary operating system commands with the privileges of the web server. This can lead to complete system compromise, including unauthorized access to sensitive data, system modification, and potential full control over the affected server (NVD).

The vulnerability requires an authenticated user with sufficient privileges to exploit. The attack vector is through the AutoDiscovery module's nmap_binary parameter in the lilac/autodiscovery.php file. The attacker must have valid authentication credentials to access the system (NVD).

A patch is available through the updated version of EyesOfNetwork. Users should upgrade to a version newer than 5.3-8. The fix is available in the official patch release (Product Vendor).

The vulnerability was reported and tracked through the EyesOfNetwork Community GitHub repository. The issue was considered critical enough to warrant immediate attention and patch development (GitHub Issue).