Lucene search

SnykCVE-2022-25923

HistoryJan 06, 2023 - 5:15 a.m.

CVE-2022-25923

2023-01-0605:15:11

CWE-78

snyk

web.nvd.nist.gov

cve-2022-25923

exec-local-bin

command injection

nvd

security vulnerability

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.7

Confidence

High

EPSS

0.004

Percentile

72.9%

JSON

Versions of the package exec-local-bin before 1.2.0 are vulnerable to Command Injection via the theProcess() functionality due to improper user-input sanitization.

Affected configurations

Nvd

Node

exec-local-bin_projectexec-local-binRange<1.2.0node.js

VendorProductVersionCPE
exec-local-bin_projectexec-local-bin*cpe:2.3:a:exec-local-bin_project:exec-local-bin:*:*:*:*:*:node.js:*:*

Vendor	Product	Version	CPE
exec-local-bin_project	exec-local-bin	*	cpe:2.3:a:exec-local-bin_project:exec-local-bin::::::node.js::*

CNA Affected

[
  {
    "product": "exec-local-bin",
    "versions": [
      {
        "version": "0",
        "lessThan": "1.2.0",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "vendor": "n/a"
  }
]

References

github.com/saeedseyfi/exec-local-bin/blob/92db00bde9d6e2d83410849f898df12f075b73b0/index.js%23L9

github.com/saeedseyfi/exec-local-bin/commit/d425866375c85038133a6f79db2aac66c0a72624

security.snyk.io/vuln/SNYK-JS-EXECLOCALBIN-3157956

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.7

Confidence

High

EPSS

0.004

Percentile

72.9%

JSON

Related for CVE-2022-25923