Lucene search

GitHub_MCVE-2021-21384

HistoryMar 19, 2021 - 12:15 a.m.

CVE-2021-21384

2021-03-1900:15:11

CWE-88

GitHub_M

web.nvd.nist.gov

shescape

shell escape

javascript

cve-2021-21384

vulnerability

nvd

CVSS2

4.6

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

34.7%

JSON

shescape is a simple shell escape package for JavaScript. In shescape before version 1.1.3, anyone using Shescape to defend against shell injection may still be vulnerable against shell injection if the attacker manages to insert a into the payload. For an example see the referenced GitHub Security Advisory. The problem has been patched in version 1.1.3. No further changes are required.

Affected configurations

Nvd

Vulners

Node

microsoftwindowsMatch-

opengroupunixMatch-

AND

shescape_projectshescapeRange<1.1.3node.js

VendorProductVersionCPE
microsoftwindows-cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
opengroupunix-cpe:2.3:o:opengroup:unix:-:*:*:*:*:*:*:*
shescape_projectshescape*cpe:2.3:a:shescape_project:shescape:*:*:*:*:*:node.js:*:*

Vendor	Product	Version	CPE
microsoft	windows	-	cpe:2.3:o:microsoft:windows:-:::::::*
opengroup	unix	-	cpe:2.3:o:opengroup:unix:-:::::::*
shescape_project	shescape	*	cpe:2.3:a:shescape_project:shescape::::::node.js::*

CNA Affected

[
  {
    "product": "shescape",
    "vendor": "ericcornelissen",
    "versions": [
      {
        "status": "affected",
        "version": "< 1.1.3"
      }
    ]
  }
]

References

github.com/ericcornelissen/shescape/commit/07a069a66423809cbedd61d980c11ca44a29ea2b

github.com/ericcornelissen/shescape/releases/tag/v1.1.3

github.com/ericcornelissen/shescape/security/advisories/GHSA-f2rp-38vg-j3gh

www.npmjs.com/package/shescape

Social References

CVSS2

4.6

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

34.7%

JSON

Related for CVE-2021-21384