CVE-2021-34078

Опубликовано: 02 июн. 2022

Источник: nvd

CVSS3: 8.8

CVSS2: 9.3

EPSS Низкий

Описание

lifion-verify-dependencies through 1.1.0 is vulnerable to OS command injection via a crafted dependency name on the scanned project's package.json file.

Ссылки

https://advisory.checkmarx.net/advisory/CX-2021-4785
Exploit
Patch
Third Party Advisory
https://github.com/lifion/lifion-verify-deps/commit/be1133d5b78e3caa0004fa60207013dca4e1bf38
Patch
Third Party Advisory
https://advisory.checkmarx.net/advisory/CX-2021-4785
Exploit
Patch
Third Party Advisory
https://github.com/lifion/lifion-verify-deps/commit/be1133d5b78e3caa0004fa60207013dca4e1bf38
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:adp:lifion-verifiy-dependencies:*:*:*:*:*:node.js:*:*

Версия до 1.2.0 (исключая)

EPSS

Процентиль: 87%

0.03214

Низкий

8.8 High

CVSS3

9.3 Critical

CVSS2

Дефекты

CWE-78

Связанные уязвимости

GHSA-rphm-c8gw-3r38