Lucene search

GitHub Advisory DatabaseGHSA-552J-PV39-F3JF

HistoryJun 03, 2022 - 12:00 a.m.

OS Command injection in ssl-utils

2022-06-0300:00:58

CWE-78

GitHub Advisory Database

github.com

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.003 Low

EPSS

Percentile

71.3%

JSON

OS Command Injection vulnerability in es128 ssl-utils 1.0.0 for Node.js allows attackers to execute arbitrary commands via unsanitized shell metacharacters provided to the createCertRequest() and the createCert() functions.

Affected configurations

Vulners

Node

sslutilsRange≤1.0.0

CPENameOperatorVersion
ssl-utilsle1.0.0

CPE	Name	Operator	Version
	ssl-utils	le	1.0.0

References

advisory.checkmarx.net/advisory/CX-2021-4782

github.com/advisories/GHSA-552j-pv39-f3jf

nvd.nist.gov/vuln/detail/CVE-2021-34080

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.003 Low

EPSS

Percentile

71.3%

JSON

Related for GHSA-552J-PV39-F3JF