CVE-2013-7377

描述

When the ffprobe functionality is enabled on the server, HTTP POST requests can be made to /probe. These requests are passed to the ffprobe binary on the server. Through this HTTP endpoint it is possible to send a malformed source file name to ffprobe that results in arbitrary command execution. ### Mitigating Factors: The ffprobe functionality is not enabled by default. In addition, exploitation opportunities are limited in a standard configuration because the server binds to the local interface by default. ## Recommendation An updated and patched version of the module (version 0.5.0) is available via npm. Users who have enabled the ffprobe functionality are especially encouraged to upgrade..

如何修補 CVE-2013-7377

要修補 CVE-2013-7377,請將受影響套件升級到下列已修補版本。

• —升級至 0.5.0 或更新版本

CVE-2013-7377 正在被利用嗎?

低 — EPSS 為 1.3%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• from 0, < 0.5.0

CVSS 分數

參考連結(5)

• ADVISORYgithub.com/advisories/GHSA-rph7-j9qr-h8q8
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2013-7377
• WEBwww.npmjs.com/advisories/2
• WEBwww.openwall.com/lists/oss-security/2014/05/13/1
• WEB