Remote Code Execution (RCE)

2017-05-0208:48:02

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.005 Low

EPSS

Percentile

76.5%

JSON

mock2easy is vulnerable to remote code execution (RCE). A malicious user can inject and execute arbitrary code due to the lack of sanitization of user input before executing the eval function.

CPENameOperatorVersion
mock2easyle0.0.24

CPE	Name	Operator	Version
	mock2easy	le	0.0.24

References

github.com/advisories/GHSA-g4xj-wcq6-qwx5

github.com/appLhui/mock2easy/blob/master/server/setConfiguration.js#L97

github.com/appLhui/mock2easy/issues/2

github.com/cristianstaicu

www.microsoft.com/en-us/research/wp-content/uploads/2017/01/nodejs_tr.pdf

www.npmjs.com/package/mock2easy

0.005 Low

EPSS

Percentile

76.5%

JSON

Related for VERACODE:4087