Growl before 1.10.0 vulnerable to Command Injection
Affected versions of `growl` do not properly sanitize input prior to passing it into a shell command, allowing for arbitrary command execution. ## Recommendation Update to version 1.10.0 or later.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2017-16042US | critical9.8 | — | ||
Growl adds growl notification support to nodejs. Growl before 1.10.2 does not properly sanitize input before passing it to exec, allowing for arbitrary command execution. | ||||
02
references
External citations — patches, advisories, analysis.
- https://github.com/tj/node-growlPACKAGE
- https://github.com/tj/node-growl/commit/d71177d5331c9de4658aca62e0ac921f178b0669WEB
- https://github.com/tj/node-growl/issues/60WEB
- https://github.com/tj/node-growl/pull/61WEB
- https://github.com/tj/node-growl/pull/62WEB
- https://nvd.nist.gov/vuln/detail/CVE-2017-16042ADVISORY
- https://www.npmjs.com/advisories/146WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan