CVE-2017-1000212 - Elixir's vim plugin, alchemist.vim is vulnerable to remote code execution in the bundled alchemist-server

Back Back to CVE browser

CRITICAL

Elixir's vim plugin, alchemist.vim is vulnerable to remote code execution in the bundled alchemist-server

Published Nov 17, 2017

9.8

CRITICAL

CVSS 3.0

EPSS 2.89%

Description

Elixir's vim plugin, alchemist.vim is vulnerable to remote code execution in the bundled alchemist-server. A malicious website can execute requests against an ephemeral port on localhost that are then evaluated as elixir code.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (0)

No CWE recorded.

References (6)

https://elixirforum.com/t/static-and-session-security-fixes-for-plug/3913
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-2876
Advisory
https://github.com/advisories/GHSA-6x65-vqp7-5r63
Advisory
https://github.com/tonini/alchemist-server/issues/14
x_refsource_CONFIRMThird Party Advisory
https://github.com/tonini/alchemist-server/pull/16
https://nvd.nist.gov/vuln/detail/CVE-2017-1000212

Link	Providers	Tags
https://elixirforum.com/t/static-and-session-security-fixes-for-plug/3913
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-2876		Advisory
https://github.com/advisories/GHSA-6x65-vqp7-5r63		Advisory
https://github.com/tonini/alchemist-server/issues/14		x_refsource_CONFIRMThird Party Advisory
https://github.com/tonini/alchemist-server/pull/16
https://nvd.nist.gov/vuln/detail/CVE-2017-1000212