PT-2022-10311 · Unknown · Lifion-Verify-Dependencies

Published 2022-06-01 · Updated 2022-06-09 · CVE-2021-34078

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions lifion-verify-dependencies versions prior to 1.1.1

Description The issue allows for OS command injection through a crafted dependency name in the package.json file of the scanned project.

Recommendations For lifion-verify-dependencies versions prior to 1.1.1, update to version 1.1.1 or later to resolve the issue.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2021-34078

GHSA-RPHM-C8GW-3R38

Affected Products

Lifion-Verify-Dependencies

References · 6

• 🔥 https://advisory.checkmarx.net/advisory/CX-2021-4785 · Exploit
• https://github.com/lifion/lifion-verify-deps/commit/be1133d5b78e3caa0004fa60207013dca4e1bf38 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-34078 · Security Note
• https://osv.dev/vulnerability/GHSA-rphm-c8gw-3r38 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-34078 · Vendor Advisory
• https://github.com/lifion/lifion-verify-deps · Note