PT-2019-17649 · Morgan · Morgan

Cris_Semmle · Published 2019-03-17 · Updated 2019-10-09 · CVE-2019-5413

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions morgan versions prior to 1.9.1

Description The issue allows an attacker to inject arbitrary commands. This can occur when user input is allowed into the filter or combined with a prototype pollution attack.

Recommendations For versions prior to 1.9.1, update to version 1.9.1 or later.

Exploit

Fix

Code Injection

Command Injection

Weakness Enumeration

CWE-94

CWE-77

Related Identifiers

CVE-2019-5413

GHSA-GWG9-RGVJ-4H5J

Affected Products

Morgan

References · 11

• 🔥 https://hackerone.com/reports/390881 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-5413 · Security Note
• https://osv.dev/vulnerability/CVE-2019-5413 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gwg9-rgvj-4h5j · Vendor Advisory
• https://github.com/nodejs/security-wg/blob/master/vuln/npm/473.json · Note
• https://github.com/advisories/GHSA-gwg9-rgvj-4h5j · Note
• https://lists.apache.org/thread.html/rb5ac16fad337d1f3bb7079549f97d8166d0ef3082629417c39f12d63%40%3Cnotifications.netbeans.apache.org%3E · Note
• https://lists.apache.org/thread.html/r8ba4c628fba7181af58817d452119481adce4ba92e889c643e4c7dd3%40%3Ccommits.netbeans.apache.org%3E · Note
• https://npmjs.com/advisories/736 · Note
• https://lists.apache.org/thread.html/r8ba4c628fba7181af58817d452119481adce4ba92e889c643e4c7dd3@%3Ccommits.netbeans.apache.org%3E · Note
• https://lists.apache.org/thread.html/rb5ac16fad337d1f3bb7079549f97d8166d0ef3082629417c39f12d63@%3Cnotifications.netbeans.apache.org%3E · Note