CVE-2019-5485
Command Injection in gitlabhook
10.0
CRITICAL
CVSS 3.1
EPSS 59.8%
Description
All versions of `gitlabhook` are vulnerable to Command Injection. The package does not validate input the body of POST request and concatenates it to an exec call, allowing attackers to run arbitrary commands in the system. ## Recommendation No fix is currently available. Consider using an alternative package until a fix is made available.
How to fix CVE-2019-5485
No fixed version has been published yet. Mitigate by removing the affected package or applying upstream guidance from the references below.
- —no fix listed
Is CVE-2019-5485 being exploited?
Likely — EPSS is 59.8%, placing CVE-2019-5485 in the top tier of vulnerabilities by exploitation probability. Prioritise patching.
Affected packages (1)
- from 0, <= 0.0.17
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | CRITICAL10.0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |