CVE-2019-5414 - If an attacker can control the port, which in itself is a very sensitive value, they can inject arbitrary OS commands due to the usage of the exec function in a third-party module kill-port < 1.3.2

Back Back to CVE browser

HIGH

If an attacker can control the port, which in itself is a very sensitive value, they can inject arbitrary OS commands due to the usage of the exec function in a third-party module kill-port < 1.3.2

Published Mar 17, 2019

8.1

HIGH

CVSS 3.0

EPSS 1.89%

Description

If an attacker can control the port, which in itself is a very sensitive value, they can inject arbitrary OS commands due to the usage of the exec function in a third-party module kill-port < 1.3.2.

Affected products

Vendor n/a Product Kill-Port Default
n/a
- Version
  < 1.3.2
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Kill-Port

n/a

Version	Status	Constraints
< 1.3.2	affected	-

Ecosystem	Package	Introduced	Fixed
npm	kill-port	0	1.3.2

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-77

CWE-78

OS Command Injection

References (4)

https://github.com/advisories/GHSA-pmv6-gf98-p3r5
Advisory
https://hackerone.com/reports/389561
x_refsource_MISCExploitThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-5414
https://www.npmjs.com/advisories/966

Link	Providers	Tags
https://github.com/advisories/GHSA-pmv6-gf98-p3r5		Advisory
https://hackerone.com/reports/389561		x_refsource_MISCExploitThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-5414
https://www.npmjs.com/advisories/966