CVE-2019-19609
57Vexday Risk Score
Priorize a correção. Ela exploração observada pelo VulnCheck e tem prova de conceito pública.
ssvc Actepss 54%
da publicação à arma633 dias
Publicada no NVD5 de dez.
1ª PoC+633d
VulnCheck+1202d
probabilidade de exploração
54%top 1% das CVEs
exploração observada
simVulnCheck
17 exploit(s) público(s)
The Strapi framework before 3.0.0-beta.17.8 is vulnerable to Remote Code Execution in the Install and Uninstall Plugin components of the Admin panel, because it does not sanitize the plugin name, and attackers can inject arbitrary shell commands to be executed by the execa function.
Produtos afetados
n/a · n/aPoCs públicas encontradas — 17
exploitdbwww.exploit-db.com/exploits/50238não verificadogithubgithub.com/diego-tella/CVE-2019-19609-EXPLOIT★ 9githubgithub.com/ebadfd/CVE-2019-19609★ 7githubgithub.com/glowbase/CVE-2019-19609★ 2githubgithub.com/n000xy/CVE-2019-19609-POC-Python★ 0githubgithub.com/RamPanic/CVE-2019-19609-EXPLOIT★ 0githubgithub.com/D3m0nicw0lf/CVE-2019-19609★ 0githubgithub.com/guglia001/CVE-2019-19609★ 0cve_referencepacketstormsecurity.com/files/163950/Strapi-CMS-3.0.0-beta.17.4-Remote-Code-Execution.htmlnão verificadovulncheckvulncheck.com/xdb/e1bc6a4c6994não verificadocve_referencepacketstormsecurity.com/files/163940/Strapi-3.0.0-beta.17.7-Remote-Code-Execution.htmlnão verificadovulncheckvulncheck.com/xdb/2fda5db4c975não verificadovulncheckvulncheck.com/xdb/f709935a6faanão verificadovulncheckvulncheck.com/xdb/50265bd1c780não verificadovulncheckvulncheck.com/xdb/010e050a13ddnão verificadovulncheckvulncheck.com/xdb/a629da38980enão verificadovulncheckvulncheck.com/xdb/8c772fa0f6d4não verificado⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
Referências
http://packetstormsecurity.com/files/163940/Strapi-3.0.0-beta.17.7-Remote-Code-Execution.htmlhttp://packetstormsecurity.com/files/163950/Strapi-CMS-3.0.0-beta.17.4-Remote-Code-Execution.htmlhttps://bittherapy.net/post/strapi-framework-remote-code-execution/https://github.com/strapi/strapi/pull/4636