CVE-2021-41280

CRITICO 9.8CVE-2021-41280 · Published 19/11/2021 · updated 17/06/2026

In breve

CVE-2021-41280 è una vulnerabilità CRITICO (CVSS 9.8) che riguarda sharetribe (sharetribe).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 3.4%, superiore al 88.9% delle vulnerabilità.
Correzione: aggiornare a 10.2.1 o successiva.

Package	Affected versions	Patched versions
sharetribe sharetribe	`< 10.2.1`	`10.2.1`

Description

Sharetribe Go is a source available marketplace software. In affected versions operating system command injection is possible on installations of Sharetribe Go, that do not have a secret AWS Simple Notification Service (SNS) notification token configured via the `sns_notification_token` configuration parameter. This configuration parameter is unset by default. The vulnerability has been patched in version 10.2.1. Users who are unable to upgrade should set the`sns_notification_token` configuration parameter to a secret value.

References

sharetribe/sharetribe commit 5b844f8 · Patch
sharetribe/sharetribe release v10.2.1 · Third Party Advisory
sharetribe/sharetribe security advisory · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free