CVE-2022-21129

Опубликовано: 31 янв. 2023

Источник: nvd

CVSS3: 7.4

CVSS3: 9.8

EPSS Низкий

Описание

Versions of the package nemo-appium before 0.0.9 are vulnerable to Command Injection due to improper input sanitization in the 'module.exports.setup' function.

Note: In order to exploit this vulnerability appium-running 0.1.3 has to be installed as one of nemo-appium dependencies.

Ссылки

https://github.com/paypal/nemo-appium/blob/master/index.js%23L27
Broken Link
https://github.com/paypal/nemo-appium/commit/aa271d36dd5c81baae3c43aa2616c84f0ee4195f
Patch
Third Party Advisory
https://security.snyk.io/vuln/SNYK-JS-NEMOAPPIUM-3183747
Exploit
Third Party Advisory
https://github.com/paypal/nemo-appium/blob/master/index.js%23L27
Broken Link
https://github.com/paypal/nemo-appium/commit/aa271d36dd5c81baae3c43aa2616c84f0ee4195f
Patch
Third Party Advisory
https://security.snyk.io/vuln/SNYK-JS-NEMOAPPIUM-3183747
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:paypal:nemo-appium:*:*:*:*:*:node.js:*:*

Версия до 0.0.9 (исключая)

EPSS

Процентиль: 83%

0.01932

Низкий

7.4 High

CVSS3

9.8 Critical

CVSS3

Дефекты

CWE-78

NVD-CWE-Other

CWE-77

Связанные уязвимости

GHSA-c6rx-gxqv-vr5j

CVSS3: 9.8

github

около 3 лет назад

nemo-appium vulnerable to OS Command Injection

EPSS

Процентиль: 83%

0.01932

Низкий

7.4 High

CVSS3

9.8 Critical

CVSS3

Дефекты

CWE-78

NVD-CWE-Other

CWE-77