CVE-2019-5413: Code Injection
Published Mar 17, 2019
·Updated
An attacker can use the format parameter to inject arbitrary commands in the npm package morgan < 1.9.1.
Other sources
Verisons of morgan before 1.9.1 are vulnerable to code injection when user input is allowed into the filter or combined with a prototype pollution attack.
Recommendation
Update to version 1.9.1 or later.
Affected Software
2 affected componentsFixes available
npm/morgan<1.9.1
1.9.1
Morgan Project Morgan Node.js<1.9.1
Event History
Mar 17, 2019
CVE Published
via MITRE·07:36 PM
Data Sourced
via MITRE·07:36 PM
DescriptionWeakness
Mar 21, 2019
Data Sourced
via NVD·04:01 PM
DescriptionSeverityWeaknessAffected Software
Mar 25, 2019
Advisory Published
06:03 PM
Frequently Asked Questions
1
What is the severity of CVE-2019-5413?
The severity of CVE-2019-5413 is critical with a score of 9.8.
2
How do I fix CVE-2019-5413?
To fix CVE-2019-5413, you should update the morgan package to version 1.9.1 or later.
3
What type of vulnerability is CVE-2019-5413?
CVE-2019-5413 is a code injection vulnerability that can result in arbitrary command execution.
4
Which software is affected by CVE-2019-5413?
The npm package morgan versions prior to 1.9.1 are affected by CVE-2019-5413.
5
Can CVE-2019-5413 lead to data exposure?
Yes, CVE-2019-5413 can lead to data exposure due to the potential for command injection.