high7.8Known exploited
CVE-2021-21315
Command Injection Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2022-01-18. Federal due date: 2022-02-01.
Apply updates per vendor instructions.
Impact
### Impact command injection vulnerability ### Patches Problem was fixed with a parameter check. Please upgrade to version >= 5.3.1 ### Workarounds If you cannot upgrade, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() ... do only allow strings, reject any arrays. String sanitation works as expected.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | systeminformation | < 5.3.1 | 5.3.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Systeminformation | Systeminformation | before 5.3.1 |
| Apache | Cordova | Version 10.0.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- CISA KEV catalog
- https://github.com/sebhildebrandt/systeminformation/commit/07daa05fb06f24f96297abaa30c2ace8bfd8b525
- https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-2m8v-572m-ff2v
- https://lists.apache.org/thread.html/r8afea9a83ed568f2647cccc6d8d06126f9815715ddf9a4d479b26b05%40%3Cissues.cordova.apache.org%3E
- https://security.netapp.com/advisory/ntap-20210312-0007/
- https://www.npmjs.com/package/systeminformation
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-21315
- https://github.com/advisories/GHSA-2m8v-572m-ff2v
- https://nvd.nist.gov/vuln/detail/CVE-2021-21315
- https://lists.apache.org/thread.html/r8afea9a83ed568f2647cccc6d8d06126f9815715ddf9a4d479b26b05@%3Cissues.cordova.apache.org%3E
- https://security.netapp.com/advisory/ntap-20210312-0007