Lucene search

GitHub Advisory DatabaseGHSA-JFM8-HWHG-R6GG

HistoryDec 20, 2022 - 6:30 a.m.

p4 vulnerable to Command Injection due to improper input sanitization

2022-12-2006:30:36

CWE-78

GitHub Advisory Database

github.com

p4 package

command injection

input sanitization

software

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

51.4%

JSON

The package p4 before 0.0.7 is vulnerable to Command Injection via the run() function due to improper input sanitization

Affected configurations

Vulners

Node

p4Range<0.0.7

VendorProductVersionCPE
*p4*cpe:2.3:a:*:p4:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
*	p4	*	cpe:2.3:a::p4::::::::*

References

github.com/advisories/GHSA-jfm8-hwhg-r6gg

github.com/natelong/p4/blob/master/p4.js#23L12

github.com/natelong/p4/blob/master/p4.js%23L12

github.com/natelong/p4/commit/ae42e251beabf67c00539ec0e1d7aa149ca445fb

nvd.nist.gov/vuln/detail/CVE-2022-25171

security.snyk.io/vuln/SNYK-JS-P4-3167330

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

51.4%

JSON

Related for GHSA-JFM8-HWHG-R6GG