In breve
- CVE-2018-21268 è una vulnerabilità CRITICO (CVSS 9.8) che riguarda traceroute (traceroute project), traceroute.
- Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 4.3%, superiore al 91.2% delle vulnerabilità.
- Nessuna versione corretta ancora nota: segui l'avviso del produttore nei riferimenti.
Description
The traceroute (aka node-traceroute) package through 1.0.0 for Node.js allows remote command injection via the host parameter. This occurs because the Child.exec() method, which is considered to be not entirely safe, is used. In particular, an OS command can be placed after a newline character.
NVD description
The traceroute (aka node-traceroute) package through 1.0.0 for Node.js allows remote command injection via the host parameter. This occurs because the Child.exec() method, which is considered to be not entirely safe, is used. In particular, an OS command can be placed after a newline character.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free