GitHub Advisoryadvisory · Packagist

GHSA-584h-jhxh-pxp2 Codiad remote code execution vulnerability

CRITICAL Published 2022-05-13 Modified 2024-04-25 Official page ↗

Aliases: CVE-2018-14009
Ecosystem: Packagist
Packages: codiad/codiad
Severity: Critical
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses: CWE-20, CWE-74
Reviewed: 2024-04-25

Affected packages

• Packagist codiad/codiad: <= 2.8.4 (no fix yet)

Description

Codiad through 2.8.4 allows Remote Code Execution, a different vulnerability than CVE-2017-11366 and CVE-2017-15689.

Related

Alias · CVE (1)

CVE-2018-14009 Codiad through 2.8.4 allows Remote Code Execution, a different vulnerability than CVE-2017-11366 and CVE-2017-15689. vulnerability

Weakness · CWE (2)

CWE-20 Improper Input Validation weakness
CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness

References