CVE-2021-21315
CVE-2021-21315 · Command Injection Vulnerability
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
The System Information Library for Node.JS (npm package "systeminformation") is an open source collection of functions to retrieve detailed hardware, system and OS information. In systeminformation before version 5.3.1 there is a command injection vulnerability. Problem was fixed in version 5.3.1. As a workaround instead of upgrading, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() ... do only allow strings, reject any arrays. String sanitation works as expected.
CVSS 7.1 · Alta · EPSS 90,7% · En el catálogo KEV · Código de explotación público · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: node
Productos y versiones afectados
systeminformation
- Versiones
- < 5.3.1: Afectada
Sin corrección publicada
systeminformation npm
- Intervalos de versiones afectados
- SEMVER: < 5.3.1
Actualiza a 5.3.1
Fuentes originales
- https://www.npmjs.com/package/systeminformation
- https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-2m8v-572m-ff2v
- https://github.com/sebhildebrandt/systeminformation/commit/07daa05fb06f24f96297abaa30c2ace8bfd8b525
- https://lists.apache.org/thread.html/r8afea9a83ed568f2647cccc6d8d06126f9815715ddf9a4d479b26b05%40%3Cissues.cordova.apache.org%3E
- https://security.netapp.com/advisory/ntap-20210312-0007/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-21315
- https://nvd.nist.gov/vuln/detail/CVE-2021-21315