Vulnerability Details CVE-2019-5413
An attacker can use the format parameter to inject arbitrary commands in the npm package morgan < 1.9.1.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.021
EPSS Ranking 83.3%
CVSS Severity
CVSS v3 Score 9.8
CVSS v2 Score 7.5
References
- https://hackerone.com/reports/390881
- https://lists.apache.org/thread.html/r8ba4c628fba7181af58817d452119481adce4ba92e889c643e4c7dd3%40%3Ccommits.netbeans.apache.org%3E
- https://lists.apache.org/thread.html/rb5ac16fad337d1f3bb7079549f97d8166d0ef3082629417c39f12d63%40%3Cnotifications.netbeans.apache.org%3E
- https://hackerone.com/reports/390881
- https://lists.apache.org/thread.html/r8ba4c628fba7181af58817d452119481adce4ba92e889c643e4c7dd3%40%3Ccommits.netbeans.apache.org%3E
- https://lists.apache.org/thread.html/rb5ac16fad337d1f3bb7079549f97d8166d0ef3082629417c39f12d63%40%3Cnotifications.netbeans.apache.org%3E
Products affected by CVE-2019-5413
-
cpe:2.3:a:morgan_project:morgan:1.0.0
-
cpe:2.3:a:morgan_project:morgan:1.0.1
-
cpe:2.3:a:morgan_project:morgan:1.1.0
-
cpe:2.3:a:morgan_project:morgan:1.1.1
-
cpe:2.3:a:morgan_project:morgan:1.2.0
-
cpe:2.3:a:morgan_project:morgan:1.2.1
-
cpe:2.3:a:morgan_project:morgan:1.2.2
-
cpe:2.3:a:morgan_project:morgan:1.2.3
-
cpe:2.3:a:morgan_project:morgan:1.3.0
-
cpe:2.3:a:morgan_project:morgan:1.3.1
-
cpe:2.3:a:morgan_project:morgan:1.3.2
-
cpe:2.3:a:morgan_project:morgan:1.4.0
-
cpe:2.3:a:morgan_project:morgan:1.4.1
-
cpe:2.3:a:morgan_project:morgan:1.5.0
-
cpe:2.3:a:morgan_project:morgan:1.5.1
-
cpe:2.3:a:morgan_project:morgan:1.5.2
-
cpe:2.3:a:morgan_project:morgan:1.5.3
-
cpe:2.3:a:morgan_project:morgan:1.6.0
-
cpe:2.3:a:morgan_project:morgan:1.6.1
-
cpe:2.3:a:morgan_project:morgan:1.7.0
-
cpe:2.3:a:morgan_project:morgan:1.8.0
-
cpe:2.3:a:morgan_project:morgan:1.8.1
-
cpe:2.3:a:morgan_project:morgan:1.8.2
-
cpe:2.3:a:morgan_project:morgan:1.9.0