CVE-2022-21235

Опубликовано: 01 апр. 2022

Источник: nvd

CVSS3: 8.1

CVSS3: 9.8

CVSS2: 6.8

EPSS Низкий

Описание

The package github.com/masterminds/vcs before 1.13.3 are vulnerable to Command Injection via argument injection. When hg is executed, argument strings are passed to hg in a way that additional flags can be set. The additional flags can be used to perform a command injection.

Ссылки

https://github.com/Masterminds/vcs/pull/105
Patch
Third Party Advisory
https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMMASTERMINDSVCS-2437078
Third Party Advisory
https://github.com/Masterminds/vcs/pull/105
Patch
Third Party Advisory
https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMMASTERMINDSVCS-2437078
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:vcs_project:vcs:*:*:*:*:*:go:*:*

Версия до 1.1.13 (исключая)

EPSS

Процентиль: 77%

0.01818

Низкий

8.1 High

CVSS3

9.8 Critical

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-88

Связанные уязвимости

CVE-2022-21235

CVSS3: 9.8

redhat

больше 3 лет назад

CVE-2022-21235

msrc

11 месяцев назад

Command Injection

GHSA-6635-c626-vj4r

CVSS3: 9.8

github

больше 4 лет назад

Command Injection Vulnerability with Mercurial in VCS

EPSS

Процентиль: 77%

0.01818

Низкий

8.1 High

CVSS3

9.8 Critical

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-88