Lucene search
Veracode Vulnerability DatabaseVERACODE:41230HistoryJul 12, 2023 - 11:18 a.m.
Command Injection
2023-07-1211:18:57
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
3
command injection
gitcommitinfo
vulnerability
validation
arbitrary commands
software
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
0.002 Low
EPSS
Percentile
54.8%
git-commit-info is vulnerable to Command Injection. The vulnerability exists due to a lack of validation in the gitCommitInfo() commit parameter, which allows an attacker to inject and execute arbitrary commands.
| CPE | Name | Operator | Version |
|---|---|---|---|
| git-commit-info | le | 2.0.1 | |
| git-commit-info | le | 2.0.1 |
Related
cve
cve
CVE-2023-26134
2023-06-28 05:15:10
osv
osv
CVE-2023-26134
2023-06-28 05:15:10
git-commit-info vulnerable to Command Injection
2023-06-28 06:30:22
cvelist
cvelist
CVE-2023-26134
2023-06-28 05:00:01
nvd
nvd
CVE-2023-26134
2023-06-28 05:15:10
github
github
git-commit-info vulnerable to Command Injection
2023-06-28 06:30:22
prion
prion
Command injection
2023-06-28 05:15:00
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
0.002 Low
EPSS
Percentile
54.8%
Related for VERACODE:41230