CVE-2018-3772
Critical
Description
Concatenating unsanitized user input in the `whereis` npm module < 0.4.1 allowed an attacker to execute arbitrary commands. The `whereis` module is deprecated and it is recommended to use the `which` npm module instead.
SeverityCritical
CVSS9.8
Exploit probability—
ProductWhereis
PublishedJul 30, 2018
First seenJul 30, 2018
Weakness typeCWE-77Command injection
How to fix
Update
- whereis_project whereis0.4.1 or later
- whereis0.4.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| whereis_project whereis | v < 0.4.1 | 0.4.1 |
| whereisnpm | v < 0.4.1 | 0.4.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.