Growl before 1.10.0 vulnerable to Command Injection
Affected versions of `growl` do not properly sanitize input prior to passing it into a shell command, allowing for arbitrary command execution. ## Recommendation Update to version 1.10.0 or later.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2017-16042US | critical9.8 | — | ||
Growl adds growl notification support to nodejs. Growl before 1.10.2 does not properly sanitize input before passing it to exec, allowing for arbitrary command execution. | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/tj/node-growlPACKAGE
- https://github.com/tj/node-growl/commit/d71177d5331c9de4658aca62e0ac921f178b0669WEB
- https://github.com/tj/node-growl/issues/60WEB
- https://github.com/tj/node-growl/pull/61WEB
- https://github.com/tj/node-growl/pull/62WEB
- https://nvd.nist.gov/vuln/detail/CVE-2017-16042ADVISORY
- https://www.npmjs.com/advisories/146WEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan