CVE-2019-10786: Improper Input Validation in network-manager
Summary
CVE-2019-10786: Improper Input Validation in network-manager. Affects network-manager versions < 1.0.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
network-manager is an npm package that provides functionality for managing network connections. It is used to configure and control network settings on various platforms. The package is vulnerable to an improper input validation issue that exists in versions up to 1.0.2. This vulnerability allows remote attackers to execute arbitrary commands by exploiting the "execSync()" argument. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
Vulnerability Detail
The vulnerability in network-manager arises from a lack of proper input validation in the "execSync()" function. This function is used to execute commands, and the vulnerability allows remote attackers to provide malicious input that can be executed as commands on the target system. Exploiting this vulnerability can lead to arbitrary command execution, potentially resulting in unauthorized access, data breaches, or system compromise. The vulnerability has been assigned the identifier CVE-2019-10786.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to a patched version of network-manager to mitigate the risk.
Conclusion
The vulnerability in network-manager allows remote attackers to execute arbitrary commands on the target system. It is crucial to update to a patched version of network-manager to mitigate the risk. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for network-manager →
FAQ
network-manager is an npm package used for managing network connections on various platforms.
This vulnerability allows remote attackers to execute arbitrary commands on the target system, potentially leading to unauthorized access, data breaches, or system compromise.
The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
No, there is no known workaround for this vulnerability. It is crucial to update to a patched version of network-manager.
To fix this vulnerability, update network-manager to a version that includes a patch for the issue.
References
Related vulnerabilities
Recent vulnerabilities recorded for network-manager.
