CVE-2022-21223

The package cocoapods-downloader before 1.6.2 are vulnerable to Command Injection via hg argument injection. When calling the download function (when using hg), the url (and/or revision, tag, branch) is passed to the hg clone command in a way that additional flags can be set. The additional flags can be used to perform a command injection.
Configurations

Configuration 1 (hide)

cpe:2.3:a:cocoapods:cocoapods-downloader:*:*:*:*:*:*:*:*

History

08 Apr 2022, 19:06

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown
v2 : 7.5
v3 : 9.8
CPE cpe:2.3:a:cocoapods:cocoapods-downloader:*:*:*:*:*:*:*:*
References (MISC) https://github.com/CocoaPods/cocoapods-downloader/pull/127 - (MISC) https://github.com/CocoaPods/cocoapods-downloader/pull/127 - Patch, Third Party Advisory
References (MISC) https://snyk.io/vuln/SNYK-RUBY-COCOAPODSDOWNLOADER-2414280 - (MISC) https://snyk.io/vuln/SNYK-RUBY-COCOAPODSDOWNLOADER-2414280 - Third Party Advisory
CWE CWE-88

01 Apr 2022, 18:15

Type Values Removed Values Added
New CVE

Information

Published : 2022-04-01 18:15

Updated : 2024-02-04 22:29


NVD link : CVE-2022-21223

Mitre link : CVE-2022-21223

CVE.ORG link : CVE-2022-21223


JSON object : View

Products Affected

cocoapods

  • cocoapods-downloader
CWE
CWE-88

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')