Lucene search

K
githubGitHub Advisory DatabaseGHSA-G4XJ-WCQ6-QWX5
HistoryMay 06, 2021 - 6:25 p.m.

Code injection in mock2easy

2021-05-0618:25:58
CWE-77
GitHub Advisory Database
github.com
39

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.005 Low

EPSS

Percentile

76.5%

This affects all versions up to and including version 0.0.24 of package mock2easy. a malicious user could inject commands through the _data variable:

Affected Area

require('../server/getJsonByCurl')(mock2easy, function(error, stdout) {
    if (error) {
        return res.json(500, error);
    }
    res.json(JSON.parse(stdout));
}, '', _data.interfaceUrl, query, _data.cookie, _data.interfaceType);```

Affected configurations

Vulners
Node
mock2easy_projectmock2easyRange0.0.24node.js
CPENameOperatorVersion
mock2easyle0.0.24

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.005 Low

EPSS

Percentile

76.5%

Related for GHSA-G4XJ-WCQ6-QWX5