CVE-2023-37473

2023-07-1421:15:09

CWE-74

[email protected]

web.nvd.nist.gov

cve-2023-37473

zenstruck/collections

information security

code execution

upgrade

entityrepository::find()

query()

nvd

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.5 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

30.9%

JSON

zenstruck/collections is a set of helpers for iterating/paginating/filtering collections. Passing callable strings (ie system) caused the function to be executed. This would result in a limited subset of specific user input being executed as if it were code. This issue has been addressed in commit f4b1c48820 and included in release version 0.2.1. Users are advised to upgrade. Users unable to upgrade should ensure that user input is not passed to either EntityRepository::find() or query().

Affected configurations

Vulners

NVD

Node

zenstruckcollectionRange<0.2.1

VendorProductVersionCPE
zenstruckcollection*cpe:2.3:a:zenstruck:collection:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
zenstruck	collection	*	cpe:2.3:a:zenstruck:collection::::::::

CNA Affected

[
  {
    "vendor": "zenstruck",
    "product": "collection",
    "versions": [
      {
        "version": "< 0.2.1",
        "status": "affected"
      }
    ]
  }
]