exploitDog

CVE-2022-25900

Опубликовано: 01 июл. 2022

Источник: nvd

CVSS3: 8.1

CVSS3: 9.8

CVSS2: 10

EPSS Низкий

Описание

All versions of package git-clone are vulnerable to Command Injection due to insecure usage of the --upload-pack feature of git.

Ссылки

https://gist.github.com/lirantal/9441f3a1212728476f7a6caa4acb2ccc
Exploit
Third Party Advisory
https://snyk.io/vuln/SNYK-JS-GITCLONE-2434308
Exploit
Patch
Third Party Advisory
https://gist.github.com/lirantal/9441f3a1212728476f7a6caa4acb2ccc
Exploit
Third Party Advisory
https://snyk.io/vuln/SNYK-JS-GITCLONE-2434308
Exploit
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:git-clone_project:git-clone:*:*:*:*:*:node.js:*:*

EPSS

Процентиль: 86%

0.02952

Низкий

8.1 High

CVSS3

9.8 Critical

CVSS3

10 Critical

CVSS2

Дефекты

CWE-88

Связанные уязвимости

GHSA-8jmw-wjr8-2x66

CVSS3: 8.1

github

больше 3 лет назад

Command injection in git-clone

EPSS

Процентиль: 86%

0.02952

Низкий

8.1 High

CVSS3

9.8 Critical

CVSS3

10 Critical

CVSS2

Дефекты

CWE-88