CVE-2017-16042

Опубликовано: 04 июн. 2018

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Низкий

Описание

Growl adds growl notification support to nodejs. Growl before 1.10.2 does not properly sanitize input before passing it to exec, allowing for arbitrary command execution.

Ссылки

https://github.com/tj/node-growl/issues/60
Third Party Advisory
https://github.com/tj/node-growl/pull/61
Patch
Third Party Advisory
https://nodesecurity.io/advisories/146
Third Party Advisory
https://github.com/tj/node-growl/issues/60
Third Party Advisory
https://github.com/tj/node-growl/pull/61
Patch
Third Party Advisory
https://nodesecurity.io/advisories/146
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:growl_project:growl:*:*:*:*:*:node.js:*:*

Версия до 1.10.2 (исключая)

EPSS

Процентиль: 91%

0.04412

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-94

CWE-78

Связанные уязвимости

CVE-2017-16042

CVSS3: 9.8

ubuntu

больше 8 лет назад

Growl adds growl notification support to nodejs. Growl before 1.10.2 does not properly sanitize input before passing it to exec, allowing for arbitrary command execution.

CVE-2017-16042

CVSS3: 8.1

redhat

около 10 лет назад

Growl adds growl notification support to nodejs. Growl before 1.10.2 does not properly sanitize input before passing it to exec, allowing for arbitrary command execution.

CVE-2017-16042

CVSS3: 9.8

debian

больше 8 лет назад

Growl adds growl notification support to nodejs. Growl before 1.10.2 d ...

GHSA-qh2h-chj9-jffq

CVSS3: 9.8

github

больше 8 лет назад

Growl before 1.10.0 vulnerable to Command Injection

EPSS

Процентиль: 91%

0.04412

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-94

CWE-78