CVE-2018-21268
Global infos:
The traceroute (aka node-traceroute) package through 1.0.0 for Node.js allows remote command injection via the host parameter. This occurs because the Child.exec() method, which is considered to be not entirely safe, is used. In particular, an OS command can be placed after a newline character.
CVE Status: Modified
References:
Metrics:
| Attribute | Value |
|---|---|
| Attack Complexity | LOW |
| Attack Vector | NETWORK |
| Availability Impact | LOW |
| Base Score | 10 |
| Base Severity | CRITICAL |
| Confidentiality Impact | HIGH |
| Integrity Impact | HIGH |
| Privileges Required | NONE |
| Scope | CHANGED |
| User Interaction | NONE |
| Vector String | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L |
| Exploitability Score | 3.9 |
| Impact Score | 6 |
| Source | [email protected] |
| Type | Secondary |