Paper/Archive/CVE-2022-25171

CVE-2022-25171

snyk — Command Injection

EPSS 2%public exploit CVSS 9.8

critical.is priorityof 100

56

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 84.5.845 × 2016.9 Exploit: SSVC poc+1010.0 SSVC exploitation: poc+100.0

Description · from the CVE record

The package p4 before 0.0.7 are vulnerable to Command Injection via the run() function due to improper input sanitization

Affected

ProductAffectedFixed inSource

p4unspecified – < 0.0.70.0.7CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

snyk (CNA)7.4CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P

CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

refsecurity.snyk.io/vuln/SNYK-JS-P4-3167330 refgithub.com/natelong/p4/blob/master/p4.js%23L12 refgithub.com/natelong/p4/commit/ae42e251beabf67c00539ec0e1d7aa149ca445fb