CVE-2020-7786: Command Injection in macfromip
Summary
CVE-2020-7786: Command Injection in macfromip. Affects macfromip versions < 1.1.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The macfromip package is an npm package that provides functionality to retrieve the MAC address from an IP address. It is commonly used in network management and security applications. The package allows users to query the MAC address of a given IP address. However, all versions of the macfromip package are affected by a command injection vulnerability. This vulnerability can be exploited by an attacker to execute arbitrary commands on the system where the package is installed.
Vulnerability Detail
The command injection vulnerability in macfromip is located in line 66 of the macfromip.js file. An attacker can manipulate the input to the package in a way that allows them to inject arbitrary commands. This can lead to various security risks, including remote code execution, unauthorized access to sensitive information, and complete compromise of the affected system. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update the macfromip package to a non-vulnerable version as soon as possible.
Conclusion
The macfromip package is vulnerable to a command injection vulnerability that allows attackers to execute arbitrary commands on the affected system. To mitigate this risk, it is crucial to update the package to a non-vulnerable version. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for macfromip →
FAQ
This vulnerability allows an attacker to execute arbitrary commands on the system where the macfromip package is installed. This can lead to remote code execution, unauthorized access to sensitive information, and complete compromise of the affected system.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your package-lock.json file, and Vulert will analyze it for any open-source vulnerabilities, including this command injection vulnerability in macfromip.
Yes, the CVSS score for this vulnerability is 9.8, indicating its critical severity.
Yes, all versions of the macfromip package are affected by this command injection vulnerability.
Yes, it is recommended to update the macfromip package to a version beyond 1.1.1 to fix this vulnerability.
