by Kastro
Paper/Archive/CVE-2022-25890

CVE-2022-25890

snyk — All versions of the package wifey are vulnerable to Command Injection via the connect() function due to improper input sanitization.

EPSS 1%public exploitCVSS 9.8
critical.is priorityof 100
54
CVSS 9.8 (NVD, ADP agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 71.4.714 × 2014.3Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

All versions of the package wifey are vulnerable to Command Injection via the connect() function due to improper input sanitization.

Affected

ProductAffectedFixed inSource
wifeyall versions–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
snyk (CNA)7.4CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refsecurity.snyk.io/vuln/SNYK-JS-WIFEY-3175615