Paper/Archive/CVE-2021-27185

CVE-2021-27185

mitre — The samba-client package before 4.0.0 for Node.js allows command injection because of the use of process.exec.

EPSS 5%CVSS 9.8

critical.is priorityof 100

48

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 92.0.920 × 2018.4 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

The samba-client package before 4.0.0 for Node.js allows command injection because of the use of process.exec.

Affected

ProductAffectedFixed inSource

n/an/a–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refgithub.com/eflexsystems/node-samba-client/releases/tag/4.0.0 refgithub.com/eflexsystems/node-samba-client/commit/5bc3bbad9b8d02243bc861a11ec73f788fbb1235 refnpmjs.com/package/samba-client refsecurity.netapp.com/advisory/ntap-20210319-0002 refadvisory.checkmarx.net/advisory/CX-2021-4302