CVE-2021-41280
Critical
Description
Sharetribe Go is a source available marketplace software. In affected versions operating system command injection is possible on installations of Sharetribe Go, that do not have a secret AWS Simple Notification Service (SNS) notification token configured via the `sns_notification_token` configuration parameter. This configuration parameter is unset by default. The vulnerability has been patched in version 10.2.1. Users who are unable to upgrade should set the`sns_notification_token` configuration parameter to a secret value.
SeverityCritical
CVSS9.8
Exploit probability—
Product
Sharetribe
PublishedNov 19, 2021
First seenNov 19, 2021
Weakness typeCWE-78OS command injection
How to fix
Update
- sharetribe sharetribe10.2.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sharetribe sharetribe | v < 10.2.1 | 10.2.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.