by Kastro
Paper/Archive/CVE-2021-23412

CVE-2021-23412

snyk — Command Injection

EPSS 4%CVSS 9.8
critical.is priorityof 100
48
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 90.6.906 × 2018.1No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

All versions of package gitlogplus are vulnerable to Command Injection via the main functionality, as options attributes are appended to the command to be executed without sanitization.

Affected

ProductAffectedFixed inSource
gitlogplus< unspecifiedunspecifiedCNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
snyk (CNA)8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refsnyk.io/vuln/SNYK-JS-GITLOGPLUS-1315832refhackerone.com/reports/808942refnpmjs.com/package/gitlogplus