CVE-2018-21268

Katalog CVE

CVSS 9.8 · Critical EPSS 4,3%

Kerentanan Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') pada traceroute project traceroute. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

The traceroute (aka node-traceroute) package through 1.0.0 for Node.js allows remote command injection via the host parameter. This occurs because the Child.exec() method, which is considered to be not entirely safe, is used. In particular, an OS command can be placed after a newline character.

Rincian

Terbit di NVD

25 Juni 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

EPSS (30 hari)

4,3% peluang dieksploitasi; lebih tinggi dari 90,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/jaw187/node-traceroute/commit/b99ee024a01a40d3d20a92ad3769cc78a3f6386f patch · advisory pihak ketiga
• https://github.com/jaw187/node-traceroute/tags advisory pihak ketiga
• https://snyk.io/vuln/npm:traceroute:20160311 exploit · advisory pihak ketiga
• https://www.linkedin.com/posts/op-innovate_shell-command-injection-through-traceroute-activity-667895645308619... advisory pihak ketiga
• https://www.npmjs.com/advisories/1465 advisory pihak ketiga
• https://www.npmjs.com/package/traceroute product · advisory pihak ketiga
• https://www.op-c.net/2020/06/17/shell-command-injection-through-traceroute-npm-package/ exploit · advisory pihak ketiga
• https://medium.com/%40shay_62828/shell-command-injection-through-traceroute-npm-package-a4cf7b6553e3