CVE-2022-38545 - Valine v1.4.18 was discovered to contain a remote code execution (RCE) vulnerability which allows attackers to execute arbitrary code via a crafted POST request

Back Back to CVE browser

CRITICAL

Valine v1.4.18 was discovered to contain a remote code execution (RCE) vulnerability which allows attackers to execute arbitrary code via a crafted POST request

Published Sep 19, 2022

9.6

CRITICAL

CVSS 3.1

EPSS 34.13%

Description

Valine v1.4.18 was discovered to contain a remote code execution (RCE) vulnerability which allows attackers to execute arbitrary code via a crafted POST request.

Affected products

Ecosystem	Package	Introduced	Fixed
npm	valine	0	1.5.0

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-74

CWE-79

Cross-site Scripting (XSS)

References (6)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-6875
Advisory
https://github.com/advisories/GHSA-mcvg-g9wx-v5vx
Advisory
https://github.com/xCss/Valine/commit/c40826c5816c98d797a6b1ed8b62bddf73ed4f65
https://github.com/xCss/Valine/issues/400
x_refsource_MISCExploitIssue TrackingThird Party Advisory
https://github.com/xCss/Valine/releases/tag/v1.5.0
https://nvd.nist.gov/vuln/detail/CVE-2022-38545

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-6875		Advisory
https://github.com/advisories/GHSA-mcvg-g9wx-v5vx		Advisory
https://github.com/xCss/Valine/commit/c40826c5816c98d797a6b1ed8b62bddf73ed4f65
https://github.com/xCss/Valine/issues/400		x_refsource_MISCExploitIssue TrackingThird Party Advisory
https://github.com/xCss/Valine/releases/tag/v1.5.0
https://nvd.nist.gov/vuln/detail/CVE-2022-38545