PT-2019-17649 · Morgan · Morgan

Cris_Semmle · Publicado 2019-03-17 · Atualizado 2019-10-09 · CVE-2019-5413

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions morgan versions prior to 1.9.1

Description The issue allows an attacker to inject arbitrary commands. This can occur when user input is allowed into the filter or combined with a prototype pollution attack.

Recommendations For versions prior to 1.9.1, update to version 1.9.1 or later.

Exploit

Correção

Code Injection

Command Injection

Enumeração de Fraquezas

CWE-94

CWE-77

Identificadores relacionados

CVE-2019-5413

GHSA-GWG9-RGVJ-4H5J

Produtos afetados

Morgan

Referências · 11

• 🔥 https://hackerone.com/reports/390881 · Exploit
• https://github.com/nodejs/security-wg/blob/master/vuln/npm/473.json · Nota
• https://github.com/advisories/GHSA-gwg9-rgvj-4h5j · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-5413 · Nota de Segurança
• https://lists.apache.org/thread.html/rb5ac16fad337d1f3bb7079549f97d8166d0ef3082629417c39f12d63%40%3Cnotifications.netbeans.apache.org%3E · Nota
• https://lists.apache.org/thread.html/r8ba4c628fba7181af58817d452119481adce4ba92e889c643e4c7dd3%40%3Ccommits.netbeans.apache.org%3E · Nota
• https://npmjs.com/advisories/736 · Nota
• https://osv.dev/vulnerability/CVE-2019-5413 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-gwg9-rgvj-4h5j · Aviso do Fabricante
• https://lists.apache.org/thread.html/r8ba4c628fba7181af58817d452119481adce4ba92e889c643e4c7dd3@%3Ccommits.netbeans.apache.org%3E · Nota
• https://lists.apache.org/thread.html/rb5ac16fad337d1f3bb7079549f97d8166d0ef3082629417c39f12d63@%3Cnotifications.netbeans.apache.org%3E · Nota