PT-2018-17490 · Facebook · React-Dev-Utils

Acdlite · Publicado 2018-12-31 · Atualizado 2021-03-25 · CVE-2018-6342

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions react-dev-utils versions 1.x.x through 1.0.3 react-dev-utils versions 2.x.x through 2.0.1 react-dev-utils versions 3.x.x through 3.1.1 react-dev-utils versions 4.x.x through 4.2.1 react-dev-utils versions 5.x.x through 5.0.1

Description The issue allows an attacker to execute arbitrary commands on a targeted system by making a network request to the server, potentially via CSRF or direct request, due to improper sanitization of input to a command that launches an editor.

Recommendations Update to version 1.0.4 for the 1.x.x release line. Update to version 2.0.2 for the 2.x.x release line. Update to version 3.1.2 for the 3.x.x release line. Update to version 4.2.2 for the 4.x.x release line. Update to version 5.0.2 for the 5.x.x release line. As a temporary workaround, consider restricting access to the vulnerable command that launches an editor until a patch is applied.

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2018-6342

GHSA-29GP-92WP-94Q8

Produtos afetados

React-Dev-Utils

Referências · 8

• https://github.com/facebook/create-react-app/pull/4866 · Nota
• https://github.com/facebook/create-react-app/releases/tag/v1.1.5 · Nota
• https://github.com/facebook/create-react-app · Nota
• https://github.com/advisories/GHSA-29gp-92wp-94q8 · Nota
• https://npmjs.com/advisories/695 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-6342 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-29gp-92wp-94q8 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-6342 · Aviso do Fabricante