Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

nvd логотип

CVE-2021-23359

Опубликовано: 18 мар. 2021
Источник: nvd
CVSS3: 7.5
CVSS3: 8.8
CVSS2: 6.5
EPSS Низкий

Описание

This affects all versions of package port-killer. If (attacker-controlled) user input is given, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization. Running this PoC will cause the command touch success to be executed, leading to the creation of a file called success.

Уязвимые конфигурации

Конфигурация 1
cpe:2.3:a:port-killer_project:port-killer:*:*:*:*:*:node.js:*:*

EPSS

Процентиль: 59%
0.0038
Низкий

7.5 High

CVSS3

8.8 High

CVSS3

6.5 Medium

CVSS2

Дефекты

CWE-78

Связанные уязвимости

CVSS3: 7.5
github
больше 4 лет назад

Code injection in port-killer

EPSS

Процентиль: 59%
0.0038
Низкий

7.5 High

CVSS3

8.8 High

CVSS3

6.5 Medium

CVSS2

Дефекты

CWE-78