OS Command Injection in devcert-sanscache · CVE-2019-10778 · GitHub Advisory Database · GitHub

OS Command Injection in devcert-sanscache

Critical severity GitHub Reviewed Published Apr 14, 2020 to the GitHub Advisory Database • Updated Jan 9, 2023

Package

devcert-sanscache (npm)

Affected versions

< 0.4.7

Patched versions

0.4.7

Description

devcert-sanscache before 0.4.7 allows remote attackers to execute arbitrary code or cause a Command Injection via the exec function. The variable commonName controlled by user input is used as part of the exec function without any sanitization.

References

Reviewed Apr 14, 2020

Published to the GitHub Advisory Database Apr 14, 2020

Last updated Jan 9, 2023

Severity

Critical

9.8

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H