Lucene search
Veracode Vulnerability DatabaseVERACODE:36589HistoryAug 03, 2022 - 4:59 p.m.
OS Command Injection
2022-08-0316:59:59
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
13
heroku-env
os command injection
get() function
shell code
app parameter
control operator
0.003 Low
EPSS
Percentile
65.2%
Heroku-env is vulnerable to OS command injection. The vulnerability is due to the function get() that executes a shell command with unsanitized user input. An attacker can inject shell code using the app parameter, using the control operator & or && followed by an arbitrary command.
| CPE | Name | Operator | Version |
|---|---|---|---|
| heroku-env | le | 0.2.0 | |
| heroku-env | le | 0.2.0 |
Related
osv
osv
heroku-env susceptible to command injection
2022-08-03 00:00:57
cvelist
cvelist
CVE-2020-28437 Command Injection
2022-08-02 00:00:00
github
github
heroku-env susceptible to command injection
2022-08-03 00:00:57
nvd
nvd
CVE-2020-28437
2022-08-02 14:15:09
cve
cve
CVE-2020-28437
2022-08-02 14:15:09
prion
prion
Code injection
2022-08-02 14:15:00