Back to overview

CVE-2018-21268

CRITICAL
10.0
CVSS 3.1
Description
The traceroute (aka node-traceroute) package through 1.0.0 for Node.js allows remote command injection via the host parameter. This occurs because the Child.exec() method, which is considered to be not entirely safe, is used. In particular, an OS command can be placed after a newline character.

Metadata

CVE ID
CVE-2018-21268
State
PUBLISHED
Assigner
mitre
Reserved
2020-06-25 00:00 UTC
Published
2020-06-25 16:56 UTC
Last updated
2024-08-05 12:26 UTC
Vendor / Product
n/a / n/a
Sources
cve.org  ·  NVD

Severity & Metrics

10.0 CRITICAL CVSS 3.1
CVSS:3.1/AC:L/AV:N/A:L/C:H/I:H/PR:N/S:C/UI:N
Affected products (1)
VendorProductPlatformVersions
n/a n/a — n/a
Weakness (CWE)
CWESourceDescription
— cna n/a
CVSS scores (1)
ScoreSeverityVersionSourceVector
10.0 CRITICAL 3.1 cna CVSS:3.1/AC:L/AV:N/A:L/C:H/I:H/PR:N/S:C/UI:N
References (8)
Back to overview