CVE-2022-21235

Опубликовано: 01 апр. 2022

Источник: nvd

CVSS3: 8.1

CVSS3: 9.8

CVSS2: 6.8

EPSS Низкий

Описание

The package github.com/masterminds/vcs before 1.13.3 are vulnerable to Command Injection via argument injection. When hg is executed, argument strings are passed to hg in a way that additional flags can be set. The additional flags can be used to perform a command injection.

Ссылки

https://github.com/Masterminds/vcs/pull/105
Patch
Third Party Advisory
https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMMASTERMINDSVCS-2437078
Third Party Advisory
https://github.com/Masterminds/vcs/pull/105
Patch
Third Party Advisory
https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMMASTERMINDSVCS-2437078
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:vcs_project:vcs:*:*:*:*:*:go:*:*

Версия до 1.1.13 (исключая)

EPSS

Процентиль: 61%

0.00412

Низкий

8.1 High

CVSS3

9.8 Critical

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-88

Связанные уязвимости

CVE-2022-21235

CVSS3: 9.8

redhat

почти 3 года назад

CVE-2022-21235

msrc

5 месяцев назад

Command Injection

GHSA-6635-c626-vj4r

CVSS3: 9.8

github

почти 4 года назад

Command Injection Vulnerability with Mercurial in VCS

EPSS

Процентиль: 61%

0.00412

Низкий

8.1 High

CVSS3

9.8 Critical

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-88