by Kastro
Paper/Archive/CVE-2021-23732

CVE-2021-23732

snyk — Arbitrary Code Execution

EPSS 2%CVSS 9.0
critical.is priorityof 100
43
CVSS 9.0 (CNA, NVD agree)9.0 / 10 × 3027.0Not in CISA KEV+300.0EPSS percentile 79.7.797 × 2015.9No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

This affects all versions of package docker-cli-js. If the command parameter of the Docker.command method can at least be partially controlled by a user, they will be in a position to execute any arbitrary OS commands on the host system.

Affected

ProductAffectedFixed inSource
docker-cli-js< unspecifiedunspecifiedCNA

Scores by source

NVD9.0CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
snyk (CNA)9.0CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

References

refsnyk.io/vuln/SNYK-JS-DOCKERCLIJS-1568516refsecurity.netapp.com/advisory/ntap-20211223-0004