Description

im-resize through 2.3.2 allows remote attackers to execute arbitrary commands via the "exec" argument. The cmd argument used within index.js, can be controlled by user without any sanitization.

Remediation

References

https://github.com/Turistforeningen/node-im-resize/commit/de624dacf6a50e39fe3472af1414d44937ce1f03

https://snyk.io/vuln/SNYK-JS-IMRESIZE-544183

Related Vulnerabilities

CVE-2021-4307 Vulnerability in maven package org.webjars.bower:baobab

CVE-2021-32702 Vulnerability in npm package nextjs-auth0

CVE-2023-40815 Vulnerability in maven package org.opencrx:opencrx-core-models

CVE-2020-28499 Vulnerability in npm package merge

CVE-2022-38723 Vulnerability in maven package io.gravitee.apim.rest.api:gravitee-apim-rest-api-service

Severity

Critical

Classification

CWE-78 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Patch Third Party Advisory Exploit