netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish GHSA-pppg-cpfq-h7wr

Browse Source
This commit is contained in:
advisory-database[bot]
2025-02-06 19:12:40 +00:00
parent bc44ff0824
commit 5db597c118
1 changed files with 11 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2024/10/GHSA-pppg-cpfq-h7wr/GHSA-pppg-cpfq-h7wr.json
+11 -3
View File
@@ -1,13 +1,13 @@
{
"schema_version": "1.4.0",
"id": "GHSA-pppg-cpfq-h7wr",
"modified": "2024-11-18T18:32:07Z",
"modified": "2025-02-06T19:11:00Z",
"published": "2024-10-11T15:30:32Z",
"aliases": [
"CVE-2024-21534"
],
"summary": "JSONPath Plus Remote Code Execution (RCE) Vulnerability",
"details": "Versions of the package jsonpath-plus before 10.0.7 are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of vm in Node.\n\n**Note:**\n\nThere was an attempt to fix it in version [10.0.0](https://github.com/JSONPath-Plus/JSONPath/commit/6b2f1b4c234292c75912b790bf7e2d7339d4ccd3) but it could still be exploited using [different payloads](https://github.com/JSONPath-Plus/JSONPath/issues/226).",
"details": "Versions of the package jsonpath-plus before 10.0.7 are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of vm in Node.\n\n**Note:**\n\nThere were several attempts to fix it in versions [10.0.0-10.1.0](https://github.com/JSONPath-Plus/JSONPath/compare/v9.0.0...v10.1.0) but it could still be exploited using [different payloads](https://github.com/JSONPath-Plus/JSONPath/issues/226)",
"severity": [
{
"type": "CVSS_V3",
@@ -32,7 +32,7 @@
"introduced": "0"
},
{
"fixed": "10.0.7"
"fixed": "10.2.0"
}
]
}
@@ -71,10 +71,18 @@
"type": "WEB",
"url": "https://github.com/JSONPath-Plus/JSONPath/issues/226#issuecomment-2424230316"
},
{
"type": "WEB",
"url": "https://github.com/JSONPath-Plus/JSONPath/pull/233"
},
{
"type": "WEB",
"url": "https://github.com/JSONPath-Plus/JSONPath/commit/6b2f1b4c234292c75912b790bf7e2d7339d4ccd3"
},
{
"type": "WEB",
"url": "https://github.com/JSONPath-Plus/JSONPath/commit/73ad72e5ee788d8287dea6e8283a3f16f63c9eb8"
},
{
"type": "WEB",
"url": "https://github.com/JSONPath-Plus/JSONPath/commit/b70aa713553caf838a63bac923195a5bc541fd72"