Arbitrary Command Injection Affecting egg-scripts package, versions <2.8.1

Threat Intelligence

0.33% (72^nd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk ID npm:egg-scripts:20180824
published 27 Aug 2018
disclosed 24 Aug 2018
credit Douglas Hal

Report a new vulnerability Found a mistake?

Introduced: 24 Aug 2018

CVE-2018-3786 Open this link in a new tab CWE-284 Open this link in a new tab

Overview

egg-scripts is a deploy tool for egg project.

Affected versions of this package are vulnerable to Arbitrary Command Injection. An attacker could perform arbitrary shell command execution through a maliciously crafted command line argument.

remediation

Upgrade egg-scripts to version 2.8.1 or higher.

References

CVSS Scores

version 3.1

Attack Vector (AV)

Local
Attack Complexity (AC)

Low
Privileges Required (PR)

None
User Interaction (UI)

Required

Scope (S)

Changed

Confidentiality (C)

High
Integrity (I)

High
Availability (A)

High