exploitDog

CVE-2022-21810

Опубликовано: 26 янв. 2023

Источник: nvd

CVSS3: 7.4

CVSS3: 7.8

EPSS Низкий

Описание

All versions of the package smartctl are vulnerable to Command Injection via the info method due to improper input sanitization.

Ссылки

https://github.com/baslr/node-smartctl/blob/f61266084d5b3e4baae9bd85f67ec4ec6a716736/index.js%23L18
Broken Link
https://security.snyk.io/vuln/SNYK-JS-SMARTCTL-3175613
Exploit
Third Party Advisory
https://github.com/baslr/node-smartctl/blob/f61266084d5b3e4baae9bd85f67ec4ec6a716736/index.js%23L18
Broken Link
https://security.snyk.io/vuln/SNYK-JS-SMARTCTL-3175613
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:smartctl_project:smartctl:*:*:*:*:*:*:*:*

EPSS

Процентиль: 58%

0.00362

Низкий

7.4 High

CVSS3

7.8 High

CVSS3

Дефекты

CWE-78

NVD-CWE-Other

CWE-77

Связанные уязвимости

GHSA-69f2-4375-qv9h

CVSS3: 7.8

github

около 3 лет назад

Command injection in smartctl

EPSS

Процентиль: 58%

0.00362

Низкий

7.4 High

CVSS3

7.8 High

CVSS3

Дефекты

CWE-78

NVD-CWE-Other

CWE-77