by Kastro
Paper/Archive/CVE-2019-5413

CVE-2019-5413

hackerone — An attacker can use the format parameter to inject arbitrary commands in the npm package morgan < 1.9.1.

EPSS 3%CVSS 9.8
critical.is priorityof 100
47
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 88.8.888 × 2017.8No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

An attacker can use the format parameter to inject arbitrary commands in the npm package morgan < 1.9.1.

Affected

ProductAffectedFixed inSource
morgan< 1.9.1–CNA

Scores by source

NVD9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refhackerone.com/reports/390881reflists.apache.org/thread.html/r8ba4c628fba7181af58817d452119481adce4ba92e889c643e4c7dd3%40%3Ccommits.netbeans.apache.org%3Ereflists.apache.org/thread.html/rb5ac16fad337d1f3bb7079549f97d8166d0ef3082629417c39f12d63%40%3Cnotifications.netbeans.apache.org%3E