CVE-2021-21315

Katalog CVE

CVSS 7.8 · High KEV · sudah dieksploitasi EPSS 90,7%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada systeminformation, apache cordova. Skor CVSS 3.1 7.8 (High) menurut NVD. Masuk katalog KEV CISA pada 18 Januari 2022, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

The System Information Library for Node.JS (npm package "systeminformation") is an open source collection of functions to retrieve detailed hardware, system and OS information. In systeminformation before version 5.3.1 there is a command injection vulnerability. Problem was fixed in version 5.3.1. As a workaround instead of upgrading, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() ... do only allow strings, reject any arrays. String sanitation works as expected.

Rincian

Terbit di NVD

16 Februari 2021

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

EPSS (30 hari)

90,7% peluang dieksploitasi; lebih tinggi dari 99,8% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

System Information Library for Node.JS Command Injection

Masuk KEV

18 Januari 2022

Tenggat CISA

1 Februari 2022 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply updates per vendor instructions.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/sebhildebrandt/systeminformation/commit/07daa05fb06f24f96297abaa30c2ace8bfd8b525 patch
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-21315 pemerintah AS
• https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-2m8v-572m-ff2v advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20210312-0007/ advisory pihak ketiga
• https://lists.apache.org/thread.html/r8afea9a83ed568f2647cccc6d8d06126f9815715ddf9a4d479b26b05%40%3Cissues.cor... issue tracking · mailing list
• https://www.npmjs.com/package/systeminformation product