CVE-2022-25973 - Arbitrary Command Execution

Back Back to CVE browser

HIGH

Arbitrary Command Execution

Published Aug 10, 2022

7.8

HIGH

CVSS 3.1

EPSS 0.49%

Description

All versions of package mc-kill-port are vulnerable to Arbitrary Command Execution via the kill function, due to missing sanitization of the port argument.

Affected products

Vendor n/a Product MC-Kill-Port Default
n/a
- Version
  0
  Status
  affected
  Constraints
  <unspecified

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

MC-Kill-Port

n/a

Version	Status	Constraints
0	affected	<unspecified

Ecosystem	Package	Introduced	Fixed
npm	mc-kill-port	0	not fixed

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-88

References (5)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-6458
Advisory
https://github.com/advisories/GHSA-2cg4-7q4x-7rr2
Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-25973
https://security.snyk.io/vuln/SNYK-JS-MCKILLPORT-2419070
x_refsource_MISCExploitThird Party Advisory
https://www.npmjs.com/package/mc-kill-port
x_refsource_MISCProductThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-6458		Advisory
https://github.com/advisories/GHSA-2cg4-7q4x-7rr2		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-25973
https://security.snyk.io/vuln/SNYK-JS-MCKILLPORT-2419070		x_refsource_MISCExploitThird Party Advisory
https://www.npmjs.com/package/mc-kill-port		x_refsource_MISCProductThird Party Advisory