CVE-2021-41280

KRITISCH 9.8CVE-2021-41280 · Published 19/11/2021 · updated 17/06/2026

Kurz gesagt

CVE-2021-41280 ist eine Schwachstelle (KRITISCH (CVSS 9.8)) in sharetribe (sharetribe).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 3.4%, höher als bei 88.9% aller Schwachstellen.
Abhilfe: auf 10.2.1 oder neuer aktualisieren.

Package	Affected versions	Patched versions
sharetribe sharetribe	`< 10.2.1`	`10.2.1`

Description

Sharetribe Go is a source available marketplace software. In affected versions operating system command injection is possible on installations of Sharetribe Go, that do not have a secret AWS Simple Notification Service (SNS) notification token configured via the `sns_notification_token` configuration parameter. This configuration parameter is unset by default. The vulnerability has been patched in version 10.2.1. Users who are unable to upgrade should set the`sns_notification_token` configuration parameter to a secret value.

References

sharetribe/sharetribe commit 5b844f8 · Patch
sharetribe/sharetribe release v10.2.1 · Third Party Advisory
sharetribe/sharetribe security advisory · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free