CVE-2019-10804 OS Command Injection in serial-number
Attackers can execute arbitrary commands via the cmdPrefix argument in the serial-number library due to lack of input validation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-10804?
CVE-2019-10804 is a critical command injection vulnerability in serial-number, published on 28 Feb 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
serial-number through 1.3.0 allows execution of arbritary commands. The "cmdPrefix" argument in serialNumber function is used by the "exec" function without any validation.
Weakness: CWE-78
Which versions are affected by CVE-2019-10804?
2 open source packages ship an affected version, including serial-number. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
serial-number npm | All versions to 1.3.0 | None |
serial-number npm | All versions to 1.3.0 | None |
Products include Serial-Number Project Serial-Number.
How do I fix CVE-2019-10804?
No fix has been published for CVE-2019-10804 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2019-10804 being exploited?
There is no known exploitation of CVE-2019-10804 in the wild and no public exploit code.
Sources
Also known as GHSA-3fw4-4h3m-892h, SNYK-JS-SERIALNUMBER-559010.