Unauthenticated Remote Command Injection in ep_imageconvert · CVE-2013-3364 · GitHub Advisory Database · GitHub

Unauthenticated Remote Command Injection in ep_imageconvert

High severity GitHub Reviewed Published Aug 31, 2020 to the GitHub Advisory Database • Updated Jan 9, 2023

Package

ep_imageconvert (npm)

Affected versions

<= 0.0.2

Patched versions

0.0.3

Description

ep_imageconvert is a plugin for Etherpad Lite. ep_imageconvert <= 0.0.2 is vulnerable to remote command injection.

Authentication is not required for remote exploitation.

Recommendation

Update to version 0.0.3 or greater.

References

Reviewed Aug 31, 2020

Published to the GitHub Advisory Database Aug 31, 2020

Last updated Jan 9, 2023

Severity

High

8.2

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N