Paper/Archive/CVE-2023-2564

CVE-2023-2564

sbs20 sbs20/scanservjs — OS Command Injection in sbs20/scanservjs

EPSS 41%public exploit CVSS 10.0

critical.is priorityof 100

60

CVSS 10.0 (NVD, CNA agree)10.0 / 10 × 3030.0 Not in CISA KEV+300.0 EPSS percentile 98.6.986 × 2019.7 Exploit: SSVC poc+1010.0 SSVC exploitation: poc+100.0

Description · from the CVE record

OS Command Injection in GitHub repository sbs20/scanservjs prior to v2.27.0.

Affected

ProductAffectedFixed inSource

sbs20/scanservjsunspecified – < v2.27.0v2.27.0CNA

Scores by source

@huntrdev (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

NVD10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refhuntr.dev/bounties/d13113ad-a107-416b-acc1-01e4c16ec461 refgithub.com/sbs20/scanservjs/pull/606/commits/d51fd52c1569813990b8f74e64ae6979c665dca1