Lucene search

GitHub Advisory DatabaseGHSA-MM4F-47CH-F7HX

HistoryApr 13, 2021 - 3:32 p.m.

Arbitrary code execution in kill-by-port

2021-04-1315:32:43

CWE-77

GitHub Advisory Database

github.com

6.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

0.005 Low

EPSS

Percentile

76.7%

JSON

This affects the package kill-by-port before 0.0.2. If (attacker-controlled) user input is given to the killByPort function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.

Affected configurations

Vulners

Node

kill-by-port_projectkill-by-portRange<0.0.2node.js

CPENameOperatorVersion
kill-by-portlt0.0.2

CPE	Name	Operator	Version
	kill-by-port	lt	0.0.2

References

github.com/advisories/GHSA-mm4f-47ch-f7hx

github.com/GuyMograbi/kill-by-port/blob/16dcbe264b6b4a5ecf409661b42836dd286fd43f/index.js#23L8

github.com/GuyMograbi/kill-by-port/commit/ea5b1f377e196a4492e05ff070eba8b30b7372c4

nvd.nist.gov/vuln/detail/CVE-2021-23363

snyk.io/vuln/SNYK-JS-KILLBYPORT-1078531

6.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

0.005 Low

EPSS

Percentile

76.7%

JSON

Related for GHSA-MM4F-47CH-F7HX