CVE-2018-3786
CRITICAL9.8EPSS 10.0%Command Injection in egg-scripts
發布日:2018/9/17修改日:2023/11/8
描述
Versions of `egg-scripts` before 2.8.1 are vulnerable to command injection. This is only exploitable if a malicious argument is provided on the command line. Example: `eggctl start --daemon --stderr='/tmp/eggctl_stderr.log; touch /tmp/malicious'` ## Recommendation Update to version 2.8.1 or later.
受影響套件(1)
- npm/egg-scriptsfrom 0, < 2.8.1
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 3.1 | CRITICAL9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
參考連結(7)
- ADVISORYhttps://github.com/advisories/GHSA-c9j3-wqph-5xx9
- ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2018-3786
- WEBhttps://github.com/eggjs/egg-scripts/blob/2.8.1/History.md
- WEBhttps://github.com/eggjs/egg-scripts/commit/b98fd03d1e3aaed68004b881f0b3d42fe47341dd
- WEBhttps://github.com/eggjs/egg-scripts/pull/26
- WEBhttps://hackerone.com/reports/388936
- WEBhttps://www.npmjs.com/advisories/694