This affects all versions of package docker-cli-js. If the command parameter of the Docker.command method can at least be partially controlled by a user, they will be in a position to execute any arbitrary OS commands on the host system.
References
| Link | Resource |
|---|---|
| https://security.netapp.com/advisory/ntap-20211223-0004/ | Third Party Advisory |
| https://snyk.io/vuln/SNYK-JS-DOCKERCLIJS-1568516 | Exploit Third Party Advisory VDB Entry |
| https://security.netapp.com/advisory/ntap-20211223-0004/ | Third Party Advisory |
| https://snyk.io/vuln/SNYK-JS-DOCKERCLIJS-1568516 | Exploit Third Party Advisory VDB Entry |
Configurations
History
21 Nov 2024, 05:51
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://security.netapp.com/advisory/ntap-20211223-0004/ - Third Party Advisory | |
| References | () https://snyk.io/vuln/SNYK-JS-DOCKERCLIJS-1568516 - Exploit, Third Party Advisory, VDB Entry |
29 Mar 2022, 16:39
| Type | Values Removed | Values Added |
|---|---|---|
| References | (CONFIRM) https://security.netapp.com/advisory/ntap-20211223-0004/ - Third Party Advisory |
23 Dec 2021, 13:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
29 Nov 2021, 21:07
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-78 | |
| References | (CONFIRM) https://snyk.io/vuln/SNYK-JS-DOCKERCLIJS-1568516 - Exploit, Third Party Advisory, VDB Entry | |
| CVSS |
v2 : v3 : |
v2 : 9.3
v3 : 9.0 |
| CPE | cpe:2.3:a:quobject:docker-cli-js:-:*:*:*:*:node.js:*:* |
22 Nov 2021, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2021-11-22 17:15
Updated : 2024-11-21 05:51
NVD link : CVE-2021-23732
Mitre link : CVE-2021-23732
CVE.ORG link : CVE-2021-23732
JSON object : View
Products Affected
quobject
- docker-cli-js
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')