Lucene search
Veracode Vulnerability DatabaseVERACODE:25692HistoryJun 16, 2020 - 8:17 a.m.
OS Command Injection
2020-06-1608:17:49
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
7
0.003 Low
EPSS
Percentile
68.8%
devcert is vulnerable to remote code execution (RCE). It is possible because it does not validate the user-provided string-concatenated input to the run() command in utils.js, which is subsequently passed to execSync, leading to execution of malicious commands.
Related
cvelist
cvelist
CVE-2020-8186
2020-07-10 15:37:18
osv
osv
Injection and Command Injection in devcert
2021-05-18 01:41:56
nvd
nvd
CVE-2020-8186
2020-07-10 16:15:11
cve
cve
CVE-2020-8186
2020-07-10 16:15:11
checkpoint_advisories
checkpoint_advisories
devcert Module Command Injection (CVE-2020-8186)
2020-08-12 00:00:00
hackerone
hackerone
nodejs
nodejs
Injection and Command Injection in devcert
2021-05-18 01:43:01
prion
prion
Command injection
2020-07-10 16:15:00
github
github
Injection and Command Injection in devcert
2021-05-18 01:41:56