요약
- CVE-2018-3772은(는) whereis (whereis project), whereis에 영향을 주는 심각 (CVSS 9.8) 취약점입니다.
- 향후 30일 내 악용 확률(EPSS): 2.8%, 전체 취약점의 86.4%보다 높음.
- 조치: 0.4.1 이상으로 업데이트하세요.
| Package | Affected versions | Patched versions |
|---|
| whereis | < 0.4.1
| 0.4.1
|
| whereis npm | < 0.4.1
| 0.4.1
|
Description
Versions of whereis before 0.4.1 are vulnerable to command injection if untrusted user input is passed into whereis.
Recommendation
Update to version 0.4.1 or later.
NVD description
Concatenating unsanitized user input in the `whereis` npm module < 0.4.1 allowed an attacker to execute arbitrary commands. The `whereis` module is deprecated and it is recommended to use the `which` npm module instead.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free