The openssl (aka node-openssl) NPM package through 2.0.0 was characterized as "a nonsense wrapper with no real purpose" by its author, and accepts an opts argument that contains a verb field (used for command execution). NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
References
| Link | Resource |
|---|---|
| https://gist.github.com/mcoimbra/b05a55a5760172dccaa0a827647ad63e | Exploit Third Party Advisory |
| https://github.com/ossf/malicious-packages/tree/main/malicious/npm | Patch |
| https://www.npmjs.com/package/openssl | Product |
Configurations
History
30 Nov 2023, 20:30
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:node-openssl_project:node-openssl:*:*:*:*:*:node.js:*:* | |
| References | () https://www.npmjs.com/package/openssl - Product | |
| References | () https://github.com/ossf/malicious-packages/tree/main/malicious/npm - Patch | |
| References | () https://gist.github.com/mcoimbra/b05a55a5760172dccaa0a827647ad63e - Exploit, Third Party Advisory | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
| CWE | CWE-77 |
24 Nov 2023, 15:24
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-11-23 20:15
Updated : 2024-08-02 22:16
NVD link : CVE-2023-49210
Mitre link : CVE-2023-49210
CVE.ORG link : CVE-2023-49210
JSON object : View
Products Affected
node-openssl_project
- node-openssl
CWE
CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')