Description

OS Command injection vulnerability in Mintzo Docker-Tester through 1.2.1 allows attackers to execute arbitrary commands via shell metacharacters in the 'ports' entry of a crafted docker-compose.yml file.

Remediation

References

https://www.npmjs.com/package/docker-tester

https://advisory.checkmarx.net/advisory/CX-2021-4786

Related Vulnerabilities

CVE-2021-21294 Vulnerability in maven package org.http4s:http4s-blaze-server_2.12

CVE-2022-24999 Vulnerability in maven package org.webjars:qs

CVE-2019-1003078 Vulnerability in maven package org.jenkins-ci.plugins:labmanager

CVE-2022-41915 Vulnerability in maven package io.netty:netty-codec

CVE-2019-15903 Vulnerability in npm package dbus

Severity

Critical

Classification

CWE-78 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Product Third Party Advisory Exploit