Lucene search

GitHub Advisory DatabaseGHSA-995X-33WQ-8GC9

HistoryDec 14, 2022 - 6:30 a.m.

cycle-import-check vulnerable to Command Injection

2022-12-1406:30:16

CWE-77

GitHub Advisory Database

github.com

vulnerable

command injection

software

user-input sanitization

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.002

Percentile

53.7%

JSON

The package cycle-import-check before version 1.3.2 is vulnerable to Command Injection via the writeFileToTmpDirAndOpenIt function due to improper user-input sanitization.

Affected configurations

Vulners

Node

cycle-import-check_projectcycle-import-checkRange<1.3.2

VendorProductVersionCPE
cycle-import-check_projectcycle-import-check*cpe:2.3:a:cycle-import-check_project:cycle-import-check:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cycle-import-check_project	cycle-import-check	*	cpe:2.3:a:cycle-import-check_project:cycle-import-check::::::::

References

github.com/advisories/GHSA-995x-33wq-8gc9

github.com/Soontao/cycle-import-check/commit/1ca97b59df7e9c704471fcb4cf042ce76d7c9890

nvd.nist.gov/vuln/detail/CVE-2022-24377

security.snyk.io/vuln/SNYK-JS-CYCLEIMPORTCHECK-3157955

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.002

Percentile

53.7%

JSON

Related for GHSA-995X-33WQ-8GC9