CVE-2018-13797: Command Injection in macaddress
Summary
CVE-2018-13797: Command Injection in macaddress. Affects macaddress versions < 0.2.9. Fixed in 0.2.9. How to fix ↓
Also tracked for
- node-macaddress · Debian:11
The same CVE-2018-13797 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The macaddress package is an npm package that provides functionality for working with MAC addresses. It allows users to manipulate and retrieve MAC addresses on a system. However, all versions of the macaddress package are vulnerable to command injection. This means that an attacker can exploit this vulnerability by controlling the iface argument to the one method. The vulnerability has a CVSS score of 9.8, indicating its critical severity.
Vulnerability Detail
The vulnerability in the macaddress package allows an attacker to execute arbitrary commands on the system by injecting malicious input into the iface argument. This can lead to various malicious activities, such as unauthorized access, data exfiltration, or even complete system compromise. The vulnerability is critical and should be addressed immediately.
How To Fix
Minimum fixed version
0.2.9
This is the first release that contains the fix.
npm install macaddress@0.2.9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The macaddress package is vulnerable to command injection, allowing attackers to execute arbitrary commands on the system. It is crucial to update to version 0.2.9 or later to fix this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for macaddress →
FAQ
This vulnerability allows an attacker to execute arbitrary commands on the system, potentially leading to unauthorized access, data exfiltration, or complete system compromise.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the package-lock.json file.
No, there is no known workaround for this vulnerability. It is recommended to update the macaddress package to the fixed version.
Yes, all versions of the macaddress package are vulnerable to this command injection vulnerability. It is crucial to update to version 0.2.9 or later.
The CVSS score of this vulnerability is 9.8, indicating its critical severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for macaddress.
