CVE-2022-0144 - Improper Privilege Management in shelljs/shelljs

Back Back to CVE browser

HIGH

Improper Privilege Management in shelljs/shelljs

Published Jan 11, 2022

7.1

HIGH

CVSS 3.1

EPSS 0.43%

Description

shelljs is vulnerable to Improper Privilege Management

Affected products

Vendor Shelljs Product Shelljs/shelljs Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <0.8.5

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Shelljs

Shelljs/shelljs

n/a

Version	Status	Constraints
unspecified	affected	<0.8.5

Red Hat Advanced Cluster Management for Kubernetes 2

rhacm2/console-rhel8

Affected
Red Hat Advanced Cluster Management for Kubernetes 2

rhacm2/kui-web-terminal-rhel8

Will not fix
Red Hat Advanced Cluster Management for Kubernetes 2

rhacm2/search-ui-rhel8

Affected
Red Hat Virtualization 4

ovirt-engine-ui-extensions

Not affected
Red Hat Virtualization 4

ovirt-web-ui

Not affected

Product	Package	State	Advisory
Red Hat Advanced Cluster Management for Kubernetes 2	rhacm2/console-rhel8	Affected	n/a
Red Hat Advanced Cluster Management for Kubernetes 2	rhacm2/kui-web-terminal-rhel8	Will not fix	n/a
Red Hat Advanced Cluster Management for Kubernetes 2	rhacm2/search-ui-rhel8	Affected	n/a
Red Hat Virtualization 4	ovirt-engine-ui-extensions	Not affected	n/a
Red Hat Virtualization 4	ovirt-web-ui	Not affected	n/a

Ecosystem	Package	Introduced	Fixed
npm	shelljs	0	0.8.5

Remediation

Red Hat statement

In Red Hat Virtualization, ShellJSis a development dependency of ovirt-engine-ui-extensions and ovirt-web-ui. Vulnerable ShellJS code is not shipped with the product.

Weaknesses (1)

CWE-269

Improper Privilege Management

References (7)

https://access.redhat.com/security/cve/CVE-2022-0144
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2043535
Issue Tracking
https://github.com/advisories/GHSA-4rq4-32rv-6wp6
Advisory
https://github.com/shelljs/shelljs/commit/d919d22dd6de385edaa9d90313075a77f74b338c
x_refsource_MISCPatchThird Party Advisory
https://huntr.dev/bounties/50996581-c08e-4eed-a90e-c0bac082679c
x_refsource_CONFIRMExploitPatchThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-0144
https://www.cve.org/CVERecord?id=CVE-2022-0144

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2022-0144		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2043535		Issue Tracking
https://github.com/advisories/GHSA-4rq4-32rv-6wp6		Advisory
https://github.com/shelljs/shelljs/commit/d919d22dd6de385edaa9d90313075a77f74b338c		x_refsource_MISCPatchThird Party Advisory
https://huntr.dev/bounties/50996581-c08e-4eed-a90e-c0bac082679c		x_refsource_CONFIRMExploitPatchThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-0144
https://www.cve.org/CVERecord?id=CVE-2022-0144