CVE-2013-3364: Unauthenticated Remote Command Injection in ep_imageconvert
Summary
CVE-2013-3364: Unauthenticated Remote Command Injection in ep_imageconvert. Affects ep_imageconvert versions < 0.0.3. Fixed in 0.0.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ep_imageconvert is a plugin for Etherpad Lite, a collaborative online editor. It allows users to convert images within the editor. However, versions of ep_imageconvert up to 0.0.2 are vulnerable to remote command injection. This means that an attacker can execute arbitrary commands on the server without authentication.
Vulnerability Detail
The vulnerability in ep_imageconvert allows an attacker to inject malicious commands into the image conversion process. This can lead to various consequences, such as unauthorized access to sensitive data, server compromise, or disruption of service. The vulnerability is rated as HIGH severity with a CVSS score of 8.2. The Common Weakness Enumeration (CWE) ID associated with this vulnerability is CWE-77.
How To Fix
Minimum fixed version
0.0.3
This is the first release that contains the fix.
npm install ep_imageconvert@0.0.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The vulnerability in ep_imageconvert can be mitigated by updating the package to version 0.0.3 or later. This will ensure that the command injection vulnerability is addressed. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ep_imageconvert →
FAQ
ep_imageconvert is a plugin for Etherpad Lite that enables image conversion within the editor.
Remote command injection is a security vulnerability that allows an attacker to execute arbitrary commands on a server remotely.
No, authentication is not required for remote exploitation of this vulnerability.
The potential consequences of this vulnerability include unauthorized access to sensitive data, server compromise, and disruption of service.
This vulnerability is rated as HIGH severity with a CVSS score of 8.2.
