Command injection

2022-10-3000:15:00

PRIOn knowledge base

www.prio-n.com

total.js remote command nvd shell metacharacters host parameter

8.8 High

AI Score

Confidence

High

0.006 Low

EPSS

Percentile

78.1%

In Total.js 4 before 0e5ace7, /api/common/ping can achieve remote command execution via shell metacharacters in the host parameter.

CPENameOperatorVersion
total.jseq< 2022926

CPE	Name	Operator	Version
	total.js	eq	< 2022926

References

github.com/totaljs/code/issues/12

www.edoardoottavianelli.it/CVE-2022-44019/

www.youtube.com/watch?v=x-u3eS8-xJg