PT-2020-9154 · Unknown · Serial-Number

Published 2020-02-28 · Updated 2021-04-13 · CVE-2019-10804

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions serial-number versions 1.3.0 and earlier

Description The issue allows execution of arbitrary commands. The cmdPrefix argument in the serialNumber function is used by the exec function without any validation.

Recommendations For versions 1.3.0 and earlier, consider disabling the serialNumber function or restricting the use of the cmdPrefix argument until a patch is available. As a temporary workaround, avoid using the exec function with unvalidated input from the serialNumber function.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2019-10804

GHSA-3FW4-4H3M-892H

SNYK-JS-SERIALNUMBER-559010

Affected Products

Serial-Number

References · 7

• 🔥 https://snyk.io/vuln/SNYK-JS-SERIALNUMBER-559010 · Exploit
• https://osv.dev/vulnerability/GHSA-3fw4-4h3m-892h · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-10804 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-10804 · Security Note
• https://github.com/es128/serial-number/blob/master/index.js#L106 · Note
• https://t.me/cibsecurity/10187 · Telegram Post
• https://t.me/cvenotify/1295 · Telegram Post