In breve
- CVE-2018-3772 è una vulnerabilità CRITICO (CVSS 9.8) che riguarda whereis (whereis project), whereis.
- Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 2.8%, superiore al 86.4% delle vulnerabilità.
- Correzione: aggiornare a 0.4.1 o successiva.
| Package | Affected versions | Patched versions |
|---|
| whereis | < 0.4.1
| 0.4.1
|
| whereis npm | < 0.4.1
| 0.4.1
|
Description
Versions of whereis before 0.4.1 are vulnerable to command injection if untrusted user input is passed into whereis.
Recommendation
Update to version 0.4.1 or later.
NVD description
Concatenating unsanitized user input in the `whereis` npm module < 0.4.1 allowed an attacker to execute arbitrary commands. The `whereis` module is deprecated and it is recommended to use the `which` npm module instead.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free