What is CVE-2021-23380?

CVE-2021-23380 is a medium-severity vulnerability in Roar-Pidusage Project, classified under OS Command Injection. CVSS score: 5.6/10. Published 2021-04-18.

How severe is CVE-2021-23380?

Medium severity. CVSS v3 base score is 5.6 out of 10.

RCE in Roar-Pidusage Project

CVE-2021-23380

This affects all versions of package roar-pidusage. If attacker-controlled user input is given to the stat function of this package on certain operating systems, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.012 (63.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.6 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L.

Affected products

Roar-pidusage_project Roar-pidusage
N/a Roar-pidusage — versions 0

Weakness classification (CWE)

CWE-78 — OS Command Injection

References

report@snyk.io (Exploit, Third Party Advisory, x_refsource_MISC)
report@snyk.io (x_refsource_MISC, Broken Link)

Frequently asked questions

What is CVE-2021-23380?: CVE-2021-23380 is a medium-severity vulnerability in Roar-Pidusage Project, classified under OS Command Injection. CVSS score: 5.6/10. Published 2021-04-18.
How severe is CVE-2021-23380?: Medium severity. CVSS v3 base score is 5.6 out of 10.