redhog/ep_imageconvert · Security
Unauthenticated Remote Command Injection in ep_imageconvert
- GHSA ID
- GHSA-28gr-86hg-r48w
- CVE ID
- CVE-2013-3364
- Severity
- high
- Published
- Updated
- CVSS
- 8.2 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
- CVSS v3
- 8.2 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Description
ep_imageconvert is a plugin for Etherpad Lite. ep_imageconvert <= 0.0.2 is vulnerable to remote command injection.
Authentication is not required for remote exploitation.
Recommendation
Update to version 0.0.3 or greater.
CWEs
- CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection')