GitHub Advisoryadvisory · Go

GHSA-723h-x37g-f8qm Chaosblade vulnerable to OS command execution

CRITICAL Published 2024-09-18 Modified 2024-09-25 Official page ↗
Aliases
CVE-2023-47105
Ecosystem
Go
Packages
github.com/chaosblade-io/chaosblade
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-78, CWE-95
Reviewed
2024-09-18

Affected packages

• Go github.com/chaosblade-io/chaosblade: >= 0.0.3, < 1.7.4 → fixed in 1.7.4

Description

exec.CommandContext in Chaosblade 0.3 through 1.7.3, when server mode is used, allows OS command execution via the cmd parameter without authentication.

Related

Alias · CVE (1)

  • CVE-2023-47105 exec.CommandContext in Chaosblade 0.3 through 1.7.3, when server mode is used, allows OS command execution via the cmd parameter without… vulnerability

Weakness · CWE (2)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness
  • CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code weakness

References