Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') Affecting openssl package, versions *
Threat Intelligence
EPSS
0.11% (45th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-OPENSSL-6084018
- published 24 Nov 2023
- disclosed 23 Nov 2023
- credit Miguel Coimbra
Introduced: 23 Nov 2023
CVE-2023-49210 Open this link in a new tabHow to fix?
There is no fixed version for openssl.
Overview
openssl is a Nodejs openssl wrapper
Affected versions of this package are vulnerable to Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') through the openssl() function due to accepting an opts argument which has verb field. An attacker can execute arbitrary commands by exploiting this vulnerability.
Note:
This vulnerability only affects products that are no longer supported by the maintainer.
References
CVSS Scores
version 3.1