CVE-2023-42810
Assigner: GitHub_M
Published: 2023-09-21T17:11:54.756Z
State: PUBLISHED
title: systeminformation SSID Command Injection Vulnerability
problemTypes: descriptions: cweId: CWE-77
description: CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
type: CWE
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
affected: vendor: sebhildebrandt
product: systeminformation
versions: version: >= 5.0.0, < 5.21.7
status: affected
descriptions: value: systeminformation is a System Information Library for Node.JS. Versions 5.0.0 through 5.21.6 have a SSID Command Injection Vulnerability. The problem was fixed with a parameter check in version 5.21.7. As a workaround, check or sanitize parameter strings that are passed to `wifiConnections()`, `wifiNetworks()` (string only).
source: advisory: GHSA-gx6r-qc2v-3p3v
discovery: UNKNOWN