Homepage

@whyour/qinglong@2.19.2-2 vulnerabilities

Timed task management platform supporting Python3, JavaScript, Shell, Typescript

  • latest version

    2.20.2-3

  • latest non vulnerable version

    2.20.2-3

  • first published

    2 years ago

  • latest version published

    13 days ago

  • licenses detected

  • View qinglong package health on Snyk Advisor  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the @whyour/qinglong package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • C
    Improper Handling of Case Sensitivity

    @whyour/qinglong is a Timed task management platform supporting Python3, JavaScript, Shell, Typescript

    Affected versions of this package are vulnerable to Improper Handling of Case Sensitivity. due to the case-sensitive string matching in authentication middleware. A remote attacker can bypasses the auth check by sending /aPi/system/command-run request instead of /api/system/command-run allowing them to obtain administrative access without authorisation.

    How to fix Improper Handling of Case Sensitivity?

    Upgrade @whyour/qinglong to version 2.20.2-0 or higher.

    <2.20.2-0
    • C
    Remote Code Execution (RCE)

    @whyour/qinglong is a Timed task management platform supporting Python3, JavaScript, Shell, Typescript

    Affected versions of this package are vulnerable to Remote Code Execution (RCE) via the application's Express.js middleware that allows to rewrite /open/* to /api/$1 api interface. A remote attacker can access the server’s initialisation flow after the server has already been configured, allowing them to reset the admin password and obtain administrative access without authorisation.

    How to fix Remote Code Execution (RCE)?

    Upgrade @whyour/qinglong to version 2.20.2-0 or higher.

    <2.20.2-0
    Go back to all versions of this package