Description

pomelo-monitor through 0.3.7 is vulnerable to Command Injection.It allows injection of arbitrary commands as part of 'pomelo-monitor' params.

Remediation

References

https://github.com/halfblood369/monitor/blob/900b5cadf59edcccac4754e5706a22719925ddb9/lib/processMonitor.js%2C

https://snyk.io/vuln/SNYK-JS-POMELOMONITOR-173695

Related Vulnerabilities

CVE-2017-7957 Vulnerability in maven package com.thoughtworks.xstream:xstream

CVE-2017-12610 Vulnerability in maven package org.apache.kafka:kafka

CVE-2018-16485 Vulnerability in npm package m-server

CVE-2019-16543 Vulnerability in maven package com.inflectra.spiratest.plugins:inflectra-spira-integration

CVE-2018-1000160 Vulnerability in npm package @risingstack/protect

Severity

Critical

Classification

CWE-78 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Third Party Advisory