Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTNweHAtNjk2My00NnI5

Command Injection in pdfinfojs

Versions of pdfinfojs before 0.4.1 are vulnerable to command injection. This is exploitable if an attacker can control the filename parameter that is passed into the pdfinfojs constructor.

Recommendation

Update to version 0.4.1 or later.

Permalink: https://github.com/advisories/GHSA-3pxp-6963-46r9
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTNweHAtNjk2My00NnI5
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: almost 6 years ago
Updated: over 1 year ago

CVSS Score: 9.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Identifiers: GHSA-3pxp-6963-46r9, CVE-2018-3746
References:

• https://nvd.nist.gov/vuln/detail/CVE-2018-3746
• https://github.com/fagbokforlaget/pdfinfojs/commit/5cc59cd8aa13ca8d16bb41da8affdfef370ad4fd
• https://hackerone.com/reports/330957
• https://github.com/advisories/GHSA-3pxp-6963-46r9
• https://www.npmjs.com/advisories/643

Repository: https://github.com/fagbokforlaget/pdfinfojs
Blast Radius: 9.4

Affected Packages